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Why GAO Did This Study 

The events of September 11, 2001, 
have placed added emphasis on 
ensuring the security of the 
nation's food supply. GAO 
examined (1) whether FDA and 
USDA have sufficient authority 
under current statutes to require 
that food processors adopt security 
measures, (2) what security 
guidelines FDA and USDA have 
provided to industry, and (3) what 
security measures food processors 
have adopted. 



What GAO Recommends 



This report recommends that the 
Secretaries of the Departments of 
Health and Human Services and 
Agriculture study their agencies' 
existing statutes to identify what 
additional authorities they may 
need relating to security measures 
at food-processing facilities to 
reduce the risk of deliberate 
contamination of the food supply. 
On the basis of these studies' 
results, the agencies should seek 
additional authority from the 
Congress, as needed. 

GAO also recommends that the 
agencies provide training for all 
food inspection personnel to 
enhance their awareness and 
ability to discuss security measures 
with plant personnel. 

USDA agreed with this report's 
recommendations. FDA agreed 
with the recommendation to 
provide training for all food 
inspection personnel but took no 
position on GAO's other 
recommendation. 

www.gao.gov/cgi-bin/getrpt7GAO-03-342. 

To view the full report, including the scope 
and methodology, click on the link above. 
For more information, contact Lawrence J. 
Dyckman at (202) 512-3841 or 
dyckmanl@gao.gov. 



What GAO Found 

Federal food safety statutes give the Food and Drug Administration (FDA) 
and the U.S. Department of Agriculture (USDA) broad authority to regulate 
the safety of the U.S. food supply but do not specifically authorize them to 
impose security requirements at food-processing facilities. However, these 
agencies' food safety statutes can be interpreted to provide authority to 
impose certain security measures. FDA believes that its statutes authorize it 
to regulate food security to the extent that food security and safety overlap 
but observes that there is little overlap between security and safety. USDA 
believes that it could require food processors to adopt certain security 
measures that are closely related to sanitary conditions inside the facility. 
USDA also believes that the statutes, however, cannot be interpreted to 
authorize the regulation of security measures that are not associated with 
the immediate food-processing environment, such as requiring fences, 
alarms, and outside lighting. Neither agency believes that it has the authority 
to regulate all aspects of security at food-processing facilities. 

Both FDA and USDA issued voluntary security guidelines to help food 
processors identify measures to prevent or mitigate the risk of deliberate 
contamination. Because these guidelines are voluntary, neither agency 
enforces, monitors, or documents their implementation. Both FDA and 
USDA have asked their inspectors to be vigilant and to discuss security with 
managers at food-processing facilities, but the agencies have stressed that 
inspectors should not enforce the implementation of security measures or 
document any observations because of the possible release of this 
information under the Freedom of Information Act and the potential for the 
misuse of this information. 

Since FDA and USDA do not monitor and document food processors' 
implementation of security guidelines, the extent of the industry's adoption 
of security measures is unknown. According to officials of trade 
associations and the five facilities we visited, however, food processors are 
implementing a range of security measures. In addition, the FDA and USDA 
field inspectors we surveyed indicated that most facilities have implemented 
some security measures, such as installing fences. However, the inspectors 
were less able to comment on security measures that were not as obvious, 
such as accounting for missing stock and implementing proper mail-handling 
practices. The inspectors also noted that while USDA has provided some of 
its field supervisory personnel with security training on the voluntary 
security guidelines it issued, it has not provided most of its inspectors with 
such training. FDA has not provided its staff with any training on the 
security guidelines. Without training on the security guidelines, inspectors 
are limited in their ability to conduct informed discussions regarding 
security with managers at food-processing facilities. 



.United States General Accounting Office 



Contents 



Letter 1 

Results in Brief 3 
Background 5 
Existing Food Safety Statutes Do Not Provide Sufficient Authority 

to Regulate All Aspects of Security at Food-Processing Facilities 9 
FDA and FSIS Issued Voluntary Security Guidelines to Food 
Processors but Do Not Track or Document the Extent to Which 
They Are Being Implemented 11 
Food Processors Are Implementing a Range of Security Measures, 
but Extent of Implementation Is Largely Unknown to FDA and 
FSIS 15 
Conclusions 22 
Recommendations for Executive Action 23 
Agency Comments and Our Evaluation 23 



Appendix I Scope and Methodology 26 



Appendix II FDA Survey Results 28 



Appendix III FSIS Survey Results 33 



Appendix IV Comments from the U.S. Department of Agriculture 43 



Appendix V Comments from the Food and Drug Administration 44 



Appendix VI GAO Contacts and Staff Acknowledgments 47 



Table 

Table 1: State Officials' Satisfaction with Federal, State, and 
Industry Efforts to Safeguard Food Products from 
Deliberate Contamination 22 



Page i 



GAO-03-342 Food-Processing Security 



Figures 

Figure 1: Examples of Security Measures Contained in FDA and 

FSIS Guidelines 12 

Figure 2: Percentage of Survey Responses Indicating Observation 

or Knowledge of More Visible Security Measures 19 

Figure 3: Percentage of Survey Responses Indicating Observation 

or Knowledge of Less Visible Security Measures 20 



Abbreviations 



CDC 


Centers for Disease Control and Prevention 


EPA 


Environmental Protection Agency 


FBI 


Federal Bureau of Investigation 


FDA 


Food and Drug Administration 


FSIS 


Food Safety and Inspection Service 


GAO 


General Accounting Office 


HACCP 


Hazard Analysis and Critical Control Point 


ISAC 


Information Sharing and Analysis Center 


USDA 


U.S. Department of Agriculture 



This is a work of the U.S. Government and is not subject to copyright protection in the 
United States. It may be reproduced and distributed in its entirety without further 
permission from GAO. It may contain copyrighted graphics, images or other materials. 
Permission from the copyright holder may be necessary should you wish to reproduce 
copyrighted materials separately from GAO's product. 



Page il 



GAO-03-342 Food-Processing Security 



February 14, 2003 



The Honorable Richard J. Durbin 
Ranking Democratic Member 
Subcommittee on Oversight of 

Government Management, 

the Federal Workforce, 

and the District of Columbia 
Committee on Governmental Affairs 
United States Senate 

The Honorable Tom Harkin 
Ranking Democratic Member 
Committee on Agriculture, Nutrition 
and Forestry 
United States Senate 

Ensuring the safety of the nation's food supply — protecting the food 
supply from unintentional contamination — is a key objective of the 
Department of Health and Human Service's Food and Drug Administration 
(FDA) and the Food Safety and Inspection Service (FSIS) of the U.S. 
Department of Agriculture (USDA). Since the terrorist attacks of 
September 11, 2001, however, ensuring food security — that is, protecting 
the food supply from deliberate contamination — has also become a 
heightened concern of these agencies. Bioterrorism experts, government 
officials, and scientists at the Centers for Disease Control and Prevention 
(CDC) and the National Academies warn that U.S. food-processing 
facilities are vulnerable to terrorist attack and that the deliberate 
introduction of biological and chemical agents into food supplies could 
sicken large numbers of people and possibly cause many deaths. Some 
experts note that terrorist groups could introduce infectious disease 
agents and chemicals into the food supply to confuse public health 
officials into believing that outbreaks were naturally occurring, thus 
delaying detection and action. Recognizing this risk, on October 8, 2001, 
the President added the agriculture and food industries to the list of 
critical infrastructure sectors needing protection from terrorist attack. 

Although the U.S. food supply has been mostly secure from deliberate 
contamination, a few such incidents have occurred. In 1984, for example, a 
cult group poisoned salad bars in some Oregon restaurants with 
Salmonella bacteria, and about 750 people became ill. Some large 
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naturally occurring outbreaks of foodborne illness that result from 
accidental contamination illustrate how widespread and costly the effects 
of deliberate contamination could be. In 1994, for example, 224,000 people 
nationwide were infected with Salmonella enteritidis after eating a 
national brand of ice cream. This outbreak was estimated to have cost 
about $18.1 million, including $6.9 million for medical care and $11.2 
million in time lost from work. 

The intentional contamination of the food supply could have severe 
consequences for the economy and the health of the American public. 
Security measures that could minimize the risk of such an event at food- 
processing facilities range from restricting visitor access, securing 
hazardous chemicals, and restricting access to in-plant laboratories to 
conducting employee background checks, building fences around 
facilities, and designating a food security management coordinator. 

In this context, you asked us to determine (1) the extent to which federal 
statutes can be effectively used to regulate food security at food- 
processing facilities; (2) what actions FDA and USDA have taken to help 
food processors prevent or reduce the risk of deliberate food 
contamination and how these agencies determine the extent to which 
food-processing facilities are implementing security measures; and 
(3) the extent to which industry is implementing security measures to 
better protect food products against deliberate contamination. While 
experts acknowledge that a terrorist attack could be aimed also at 
livestock and crops on farms or at foods at retail stores, this review 
focused on the food-processing segment of the farm-to-table food 
continuum — that is, from the farm gate to the retail level. Also, we 
confined our review to domestic food processors, although we recognize 
that both FDA and USDA have intensified their efforts to enhance the 
oversight of imported foods at U.S. ports of entry. 

In conducting our work, we sought the cooperation of industry 
associations to survey a representative number of food-processing 
facilities. We also sought permission to visit some food-processing 
facilities to discuss the extent to which they are implementing security 
measures, although we acknowledge that industry is not obligated to 
respond to our inquiries. We were unsuccessful in our attempts to survey a 
representative number of food-processing facilities because companies 
were concerned about sharing information on security measures; 
however, we were able to secure visits to five companies. To obtain a 
broader overview of the security measures being adopted, we also 
surveyed FDA and USDA food inspectors to obtain their views on the 
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extent of security they have observed at food-processing facilities they 
inspect across the country. We also asked state audit offices in all 50 states 
to interview a selected number of state food safety regulatory officials 
concerning their food security activities, if any. Eleven agreed to 
participate. Appendix I contains the details of our scope and methodology. 
We conducted our review from February through December 2002 in 
accordance with generally accepted government auditing standards. 



RGSllltS in Brief Federal food safety statutes provide FDA and USDA with broad authority 

to regulate the safety of the U.S. food supply but do not specifically 
authorize them to impose security requirements at food-processing 
facilities. However, while these agencies' food safety statutes can be 
interpreted to provide authority to impose certain security requirements, 
as opposed to food safety requirements, neither agency believes it has the 
authority to regulate all aspects of security. FDA believes that its 
authorities under the Federal Food, Drug, and Cosmetic Act and the Public 
Health Service Act would extend to the regulation of facility security 
measures to prevent the intentional contamination of food products to the 
extent that they overlap with food safety. However, FDA observes that 
there is little overlap between safety and security. USDA believes that the 
Federal Meat, Poultry Products, and Egg Products Inspection Acts can be 
construed to authorize it to require food processors to adopt certain 
security measures that are closely related to sanitary conditions inside 
food-processing plants. In addition, USDA believes that the statutes cannot 
be interpreted to authorize the regulation of security measures that are not 
associated with the immediate food-processing environment. As a result, 
USDA does not believe it has the authority to require that food processors 
adopt measures to ensure security outside the premises, such as installing 
fences, or to require that food processors conduct employee background 
checks. 



Both FDA and USDA have issued voluntary guidelines to help food 
processors identify measures they can implement to prevent or mitigate 
the risk of deliberate contamination. Because these guidelines are 
voluntary, neither agency monitors or documents their implementation. 
Also, FDA and FSIS have instructed their food safety inspectors to be 
familiar with the agencies' guidelines as they conduct regular food safety 
inspections and to discuss, but not interpret, the security guidelines with 
facility personnel. The agencies have told inspectors not to document the 
existence or lack of security measures because of the possible release of 
this information under the Freedom of Information Act and the potential 
for the misuse of this information. As a result, FDA and FSIS do not have 
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information on the extent of security at food-processing facilities or 
whether gaps in security may exist in specific industry sectors. 

FDA and USDA lack comprehensive information on the extent to which 
food-processing companies are adopting security measures. However, 
officials from the food trade associations that we contacted believe that 
food processors are voluntarily implementing a range of security 
measures, including those in the federal guidelines — from limiting access 
to facilities to evaluating plant security. Although we found this to be the 
case at the five food-processing facilities we visited, we could not verify 
the extent to which industry has adopted security measures nationwide — 
in part, because food-processing facilities prefer not to share information 
about their security measures with federal agencies. They are concerned 
that this sensitive information could be released to the public under the 
Freedom of Information Act. In particular, the industry is worried that if 
security gaps at food-processing facilities were made public they could 
provide a road map for terrorist groups. FDA and FSIS officials also cited 
this concern as a factor that limits the amount of information they believe 
they can collect. In addition, according to FDA and FSIS food inspectors 
we surveyed, the food-processing facilities they regularly inspect are 
voluntarily implementing a range of security measures and most facilities 
have implemented measures to enhance perimeter fencing and lighting. On 
the other hand, these inspectors were less able to comment on less-visible 
security measures, such as accounting for missing stock and implementing 
proper mail-handling practices. The inspectors also indicated that larger 
food-processing facilities are implementing more security measures than 
smaller ones. Finally, the FDA inspectors that we surveyed stated that they 
had not received training on food security even though the agency 
encourages them to discuss security matters with plant personnel. FSIS 
has provided training to its supervisory field inspection personnel, who 
reported that it would be beneficial if the field inspectors — who are most 
directly involved with daily processing activities at each plant — were also 
trained on security measures. 

This report recommends that the Secretary of the Department of Health 
and Human Services and the Secretary of Agriculture study what 
additional authorities their agencies may need relating to security 
measures at food-processing facilities to reduce the risk of deliberate 
contamination of the food supply. On the basis of the results of these 
studies, the agencies should seek additional authority from the Congress, 
as needed. The report also recommends executive action aimed at 
ensuring that the agencies' field personnel are provided with training on 
food security measures. 
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We provided FDA and USDA with a draft of this report for their review 
and comment and received written and oral comments from both agencies 
on the report's contents and its recommendations. The agencies also 
provided technical comments, which we incorporated into the report as 
appropriate. USDA agreed with the two recommendations made in this 
report. FDA agreed with our recommendation that it provide all food 
inspection personnel with training on security measures. FDA did not have 
an opinion on our recommendation that the agency study what additional 
authorities it may need relating to security measures at food-processing 
facilities. USD As comments are contained in appendix IV, and FDA's 
comments are provided in appendix V. 



Background Under the Federal Meat Inspection Act, the Poultry Products Inspection 

° Act, and the Egg Products Inspection Act, USDA, through FSIS, is 

responsible for ensuring the safety of meat, poultry, and certain egg 
products. Under the Federal Food, Drug, and Cosmetic Act and the Public 
Health Service Act, FDA is responsible for all other foods, including fruits 
and vegetables; dairy products; seafood; and certain canned, frozen, and 
packaged foods. The food-processing sector is generally described as the 
middle segment of the farm-to-table continuum — it extends from the time 
livestock and crops leave the farm for slaughter and processing into food 
until it reaches retail establishments. 



FDA and FSIS work to ensure the safety of food products processed in the 
United States through a regulatory system of preventive controls that 
identifies hazards early in the production process to minimize the risk of 
contamination. Known as the Hazard Analysis and Critical Control Point 
(HACCP) system, it makes food-processing facilities responsible for 
developing a plan that identifies harmful microbiological, chemical, and 
physical hazards that are reasonably likely to occur and establishes critical 
control points to prevent or reduce contamination. 1 Through their 
inspection programs, FDA and FSIS verify that food processors are 
implementing their HACCP plans. FDA inspects over 57,000 food facilities 
every 5 years on average, and USDA inspects over 6,000 meat and poultry 
slaughter and processing facilities daily. Individual states also conduct 
yearly inspections of about 300,000 food-processing facilities, including 
small firms with fewer than 10 employees and large corporations with 
thousands of employees and multiple processing plants located in many 



'FDA's HACCP program applies only to seafood and juice, not to all FDA-regulated food. 
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states. Both FDA and FSIS have the authority to take enforcement actions 
as necessary to ensure that facilities meet the agencies' safety and 
sanitation regulatory requirements. As we reported in 2001, in fiscal year 
1999, the latest year for which such information was available, FDA, FSIS, 
and the states spent a total of about $1.3 billion on food safety activities. 2 

Following the events of September 11, 2001, the federal government 
intensified its efforts to address the potential for deliberate contamination 
of agriculture and food products. On October 8, 2001, the President issued 
an executive order establishing the Office of Homeland Security, which 
added the agriculture and food industries to the list of critical 
infrastructure systems needing protection from terrorist attack. In 
addition, the Congress provided FDA and USDA with emergency funding 
to prevent, prepare for, and respond to potential bioterrorist attacks 
through the Department of Defense Appropriation Act of 2002: $97 million 
for FDA and $15 million for FSIS. For the most part, FDA has used the 
emergency funds to enhance the security of imported food by hiring new 
inspectors and increasing inspections at U.S. ports of entry. FSIS has used 
its emergency funds to support its food security activities, which include, 
among other things, providing educational and specialized training. FDA's 
fiscal year 2003 budget builds upon funding received from the fiscal year 
2002 appropriation plus the fiscal year 2002 emergency supplemental 
funding of $97 million to counter terrorism. FDA plans to seek additional 
funding in the future for food safety activities and security activities 
related to terrorism. FSIS is asking for an additional $28 million. The 
Congress also enacted the Public Health Security and Bioterrorism 
Preparedness and Response Act of 2002, which contains numerous 
provisions designed to enhance the safety and security of the food, drug, 
and water industries. 3 

In addition, both FDA and USDA have taken many actions to better 
protect the food supply against deliberate contamination. For example, 
FDA has hired 655 new food safety investigators and laboratory personnel 
in the field. In addition, it has participated in several exercises at the 



2 See U.S. General Accounting Office, Food Safety: Overview of Federal and State 
Expenditures, GAO-01-177 (Washington, D.C.: Feb. 20, 2001). 

3 This act contains provisions that provide FDA with new authority to detain products that 
are believed to present a serious health threat. It also authorizes FDA to debar importers 
who have been convicted of certain food import violations, which results in the denial of 
delivery of products to those importers. 
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federal and state levels to enhance emergency response procedures. 
Furthermore, FDA is working with CDC to initiate and implement a 
nationwide Laboratory Response Network for foods to identify laboratory 
capacity for testing agents that could be used to deliberately contaminate 
food. It has also provided additional laboratory training for food safety 
personnel and sought stakeholders' input to develop regulations that are 
required by the new bioterrorism legislation. Moreover, FDA worked with 
the Office of the Surgeon General, U.S. Air Force, to adapt a version of the 
Operational Risk Management approach to examine the relative risks of 
intentional contamination during various stages of food production and 
distribution. 4 Within the Department of Health and Human Services, both 
FDA and CDC have worked closely with federal, state, and local agencies 
to enhance their surveillance of diseases caused by foodborne pathogens. 
FDA's efforts to reduce food security risks also include working with other 
federal agencies, trade associations, and the Alliance for Food Security. 

USDA has formed a Homeland Security Council to develop a Department- 
wide plan to coordinate efforts between all USDA agencies and offices. 
The Department has also established the FSIS Office of Food Security and 
Emergency Preparedness to centralize the Department's work on security 
matters. USDA has also coordinated with other government agencies, such 
as the Office of Homeland Security, the Federal Bureau of Investigation 
(FBI), and FDA, to develop prevention, detection, and response 
procedures to better protect the nation's food supply. 5 USDA will be 
increasing the number of import inspectors by 20. These inspectors will 
place special emphasis on food security in addition to their traditional 
food safety role. In addition, USDA has participated in several exercises at 
the federal and state levels to enhance response procedures and has 
conducted risk assessments for domestic and imported food. Since this 
review began, USDA has conducted three simulation exercises at the 
Department and agency level to test the Department's response to a 
terrorist attack and is planning three additional simulations for the spring 
of 2003. USDA has also conducted preparedness-training sessions for 
veterinarians and circuit supervisors. (Circuit supervisors supervise the 



Operational Risk Management is an approach to risk assessment that increases 
operational effectiveness by anticipating hazards and reducing the potential for loss. 

a On November 25, 2002, President Bush signed the Homeland Security Act of 2002, which 
created the Department of Homeland Security. The Department will replace the Office of 
Homeland Security. 
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work of in-plant inspection personnel and discuss the security guidelines 
with them.) 

Experts from government and academia generally agree that terrorists 
could use food products as a vehicle for introducing harmful agents into 
the food supply. Just recently, the National Academies reported that 
terrorists could use toxic chemicals or infectious agents to contaminate 
food production facilities and that, although much attention has been paid 
to ensuring safety and purity throughout the various stages of processing 
and distribution, protecting the food supply from intentional 
contamination has not been a major focus of federal agencies. 6 Among 
other things, the report says that FDA should act promptly to extend its 
HACCP methodology so that it could be used to deal effectively with the 
deliberate contamination of the food supply. In February 2002, CDC 
reported that although the food and water systems in the United States are 
among the safest in the world, the nationwide outbreaks due to 
unintentional food or water contamination demonstrate the ongoing need 
for vigilance in protecting food and water supplies. 7 All of the bioterrorism 
experts whom we consulted from academia agreed that the food supply is 
at risk. 



6 See National Research Council of the National Academies, Making the Nation Safer: The 
Role of Science and Technology in Countering Terrorism (Washington, D.C: June 2002). 

'See Centers for Disease Control and Prevention, Public Health Assessment of Potential 
Biological Terrorism Agents, Emerging Infectious Diseases (Atlanta, Ga.: February 2002), 
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Existing Food Safety 
Statutes Do Not 
Provide Sufficient 
Authority to Regulate 
All Aspects of 
Security at Food- 
Processing Facilities 



The food safety statutes do not specifically authorize FDA or USDA to 
require food processors to implement any type of security measures 
designed to prevent the intentional contamination of the foods they 
produce. 8 While these agencies' food safety statutes can be interpreted to 
provide authority to impose certain security requirements, as opposed to 
food safety requirements, neither agency believes it has the authority to 
regulate all aspects of security. 

Counsel in the Department of Health and Human Service's Office of the 
Assistant Secretary for Legislation advised that FDA's authorities under 
the Federal Food, Drug, and Cosmetic Act and the Public Health Service 
Act provide FDA with tools to adopt measures to control insanitary 
preparation, packing, and holding conditions that could lead to unsafe 
food; detect contamination of food; and control contaminated food. 
However, Counsel also advised that FDA's food safety authorities do not 
extend to the regulation of physical facility security measures. FDA's 
counsel provided a similar assessment, telling us that, to the extent that 
food safety and security overlap, FDA might be able to require the industry 
to take precautionary steps to improve security but observed that there is 
little overlap between safety and security. One area where safety and 
security do overlap is in the handling of hazardous materials. FDA's 
existing safety regulations specify that hazardous chemicals should be 
stored so that they cannot contaminate food products. This requirement 
overlaps with FDA's food security guidelines advising that hazardous 
chemicals be stored in a secure area and that access to them be limited. 



USDA, on the other hand, has a somewhat more expansive view of the 
extent to which its statutory authority allows it to require food processors 
to adopt certain security measures. USDA's general counsel concluded 
that to the extent that security precautions pertain to activities closely 
related to sanitary conditions in the food preparation process, FSIS has 
the authority to require food processors to implement certain security 



FDA, under the Federal Food, Drag, and Cosmetic Act and the Public Health Service Act, 
and USDA, under the Federal Meat Inspection Act, Poultry Products Inspection Act, and 
the Egg Products Inspection Act, have broad authority to regulate food safety. These laws 
require that food products be processed under sanitary conditions, be unadulterated, and 
be properly labeled. 
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measures. 9 The general counsel concluded that FSIS could require 
facilities to develop and maintain a food security management plan 
concerning their response to an actual threat involving product tampering, 
since this is directly related to food adulteration. Such a plan could be 
added to a current HACCP plan or it could be entirely separate. USDA also 
believes that FSIS has authority to mandate its "inside security" guidelines, 
such as controlling or restricting access to certain areas, monitoring the 
operation of equipment to prevent tampering, and keeping accurate 
inventories of restricted ingredients and hazardous chemicals. Similarly, 
USDA believes that many of its security measures that address shipping 
and receiving food products or protecting water and ice used in processing 
products also could be made mandatory. These measures include putting 
tamper-proof seals on incoming and outgoing shipments and controlling 
access to water lines and ice storage. 

On the other hand, USDA believes that the "outside security" measures 
included in its guidelines, such as securing plant boundaries and providing 
guards, alarms, and outside lighting, have little to do with sanitation in the 
facility or the immediate food-processing environment and, therefore, 
could not be made mandatory under existing authorities. With respect to 
the guidelines' personnel security measures, USDA noted that FSIS has 
limited authority over personnel matters at food-processing facilities and 
could not require facilities to perform personnel background checks 
before hiring. 



USDA's view on its authority to impose security requirements that are closely related to 
sanitary conditions is derived from the food safety laws' prohibitions against adulteration. 
Adulterated food is virtually identically defined in the Federal Food, Drug, and Cosmetic 
Act and the Federal Meat, Poultry Products, and Egg Products Inspection Acts as food that 
has been "prepared, packed, ["packaged" in the egg inspection act] or held under insanitary 
conditions whereby it may have become contaminated with filth, or whereby it may have 
been rendered injurious to health." See 21 U.S.C. 342(a)(4), 21 U.S.C. 601(m)(4), 21 U.S.C. 
453(g)(4) and 21 U.S.C. 1033(a)(4). 
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FDA and FSIS Issued 
Voluntary Security 
Guidelines to Food 
Processors but Do 
Not Track or 
Document the Extent 
to Which They Are 
Being Implemented 



In response to the nation's growing concerns regarding the potential for 
deliberate contamination of the food supply, FDA and USDA issued 
guidelines to the food-processing industry suggesting measures to enhance 
security at their facilities. Among other things, the guidelines suggests 
conducting a risk assessment, developing a plan to address security risks 
at plants, and adopting a wide range of security measures inside and 
outside the premises. Food-processing facilities are not required to adopt 
any of the security measures but are encouraged to adopt those that they 
feel are best suited for their operations. Although both agencies have 
alerted their field inspection personnel to be vigilant about security issues, 
they have also told the inspectors that they are not authorized to enforce 
these measures and have instructed them not to document their 
observations regarding security because of the possible release of this 
information under the Freedom of Information Act and the potential for 
the misuse of this information. As a result, FDA and USDA currently do 
not know the extent to which food security measures are being 
implemented at food-processing facilities. In contrast, the Congress 
directed medium-size and large-size community water systems, which are 
privately or publicly owned, to assess their vulnerability to terrorist 
attacks and to develop an emergency response plan to prepare for such an 
event. The act also authorized funding to be used for basic security 
enhancements, such as the installation of fencing, gating, lighting, or 
security cameras. This approach enables the Environmental Protection 
Agency (EPA) to monitor the water industry's security efforts and could 
be a possible model for the food safety agencies. 



Industry's Compliance 
with Security Guidelines Is 
Voluntary 



In 2002, FDA and FSIS each issued voluntary security guidelines to the 
food-processing industry to help federal- and state-inspected plants 
identify ways to enhance their security. 10 The agencies encouraged food 
processors, among others, to review their current operations and adopt 
those security measures suggested in the guidelines that they believed 
would be best suited for their facilities. Officials from both FDA and FSIS 
told us that there was little or no coordination between the two agencies 
in developing these guidelines. The FDA guidance contains over 100 
recommended security measures covering seven areas of plant operation, 
such as managing food security, physical (outside) security, and computer 
security. FSIS's guidelines contain 68 security measures and cover seven 



FDA was first to issue guidelines in January 2002; FSIS subsequently issued its guidelines 
in May 2002. 
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areas of plant operation. Figure 1 summarizes key aspects of both 
agencies' voluntary security guidelines for industry. FDA and FSIS have 
made the guidelines available on the Internet. 11 These guidelines are very 
similar — one difference is that FSIS's contain security measures for 
slaughter facilities. 



Figure 1 : Examples of Security Measures Contained in FDA and FSIS Guidelines 



• Security procedures for visitors -Visitors, guests, and other nonplant employees should provide proof of 
identity and be restricted to nonproduct areas unless accompanied by a responsible employee. 

• Laboratory security- In-house laboratory facilities should have comprehensive and validated security and 
disposal procedures in place, such as restricting access to the lab and controlling pathogens. 

• Mail-handling security- Mail handling should be done in a separate area, and mail should be screened for 
anything out of the ordinary. 



Shipping and receiving security-Inspection of all incoming shipments for signs of tampering and any 
irregularities in products or labels should be investigated immediately. 

Personnel security- A system of positive identification should be established, new hires should be subject 
to screenings and background checks, entry to plant should be controlled, and personal items should 
be restricted. 



• Computer system security- Procedures for backing up critical data systems should be reviewed, and 
access to computer systems should be restricted to those with proper clearances. 

• Hazardous chemical security -Hazardous chemical storage areas or rooms should be secured and isolated 
from other parts of the plant, access to these areas should be controlled, and all irregularities in stock should 
be investigated immediately. 

• Outside security -Outside lighting should be sufficient to detect unusual activities; all access to the 
establishment should be monitored and controlled; parking areas for visitors should be a safe distance 

from the facility; and all doors, windows, roof openings, vent openings, and storage areas should be secured. 



Source: FDA and FSIS. 



Some state governments have also acted to protect food products from 
deliberate contamination. We learned from 11 state auditing offices that 
food safety regulatory officials from most of these states are providing 
industry or state inspectors with guidelines, either in the form of the FDA 
and FSIS guidelines or guidelines developed by the state officials 



See www.cfsan.fda.gov/~dms/secguid.html for FDA and 
www.fsis.usda.gov/oa/topics/securityguide.htm for FSIS. 
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themselves. 12 In addition, three states have enacted new legislation or 
regulations addressing the security of food products. 



FDA and FSIS Instruct Although FDA and FSIS do not assess the extent to which food processors 

Their Inspectors to Be are implementing security measures, the agencies have asked their field 

Observant inspection personnel to be on heightened alert and to discuss, but not 

interpret, the security guidance with facility officials during their routine 
food safety inspections. 13 However, both FDA and USDA have instructed 
their field inspection personnel to refrain from enforcing any aspects of 
the security guidelines because the agencies generally believe that they 
lack such authority. They have also instructed their field personnel not to 
document plants' security measures because they are concerned that such 
information would be subject to Freedom of Information Act requests. 

More specifically, FDA's instructions to its field personnel specify that 
they should neither perform a comprehensive food security audit of the 
establishment nor conduct extensive interviews to determine the extent to 
which preventive measures suggested in the guidelines have been adopted. 
The goals, according to FDA, are to heighten industry's awareness of food 
security practices, facilitate an exchange of information between FDA and 
industry on the subject of food security, and encourage plant management 
to voluntarily implement those preventive measures that they believe are 
most appropriate for their operation. In short, FDA inspectors are 
encouraged to discuss food security concerns with plant management and 
to provide them with copies of the guidelines. Although the exact details 
of such discussions are not to be recorded, inspectors are required to 
document in their inspection reports that such discussions took place and 
that they gave a copy of the guidelines to facility management. 

Similarly, FSIS has informed its field inspectors that they have no 
regulatory duties regarding the enforcement of the guidelines. Initially, the 
agency instructed its inspectors to refer any questions from facility 



"Eleven of the 50 state audit offices we contacted for assistance in interviewing their food 
regulatory officials responded to our request. The participating state auditing offices were 
Arizona, Florida, Maryland, Michigan, New York, North Carolina, Oklahoma, Oregon, 
Pennsylvania, Tennessee, and Texas. Because the state auditors collected information from 
only 11 states, these observations cannot be generalized. 

13 According to an FSIS memorandum to its field personnel, "heightened alert" is defined as 
identifying and reporting any suspicious activities that could adversely affect our nation's 
security. 
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managers to USDA's Technical Service Center in Omaha, Nebraska. 14 
Recently the agency modified its position regarding direct discussions of 
food security and now allows inspectors to discuss, but not interpret, 
security with facility management. Inspectors are still instructed not to 
document these conversations or enforce the adoption of any security 
measure. 

Officials from both agencies expressed concerns about gathering security 
information from facilities because it could be subject to public disclosure 
through Freedom of Information Act requests. If terrorists gained access 
to this information, it could give them a road map to target the most 
vulnerable areas in a food-processing plant. 



Water Security Provisions 
in the 2002 Bioterrorism 
Act Are a Possible Model 
for the Food Safety 
Agencies 



Recent congressional efforts to better protect the nation's drinking water 
from terrorist acts may offer a model for FDA and USDA to help monitor 
security measures adopted at food-processing facilities as well as to 
identify any security gaps that may exist at these facilities. Although there 
are differences in how the government regulates drinking water and food, 
food and water are essential daily consumption elements, and both are 
regulated to ensure their safety. 

In June 2002, the Congress enacted the Public Health Security and 
Bioterrorism Preparedness and Response Act of 2002, which, among other 
things, amended the Safe Drinking Water Act. The Bioterrorism Act 
requires medium-size and large-size community water systems (those 
serving over 3,300 people), which are privately and publicly owned, to 
certify to EPA that they have assessed their vulnerability to a terrorist 
attack and developed emergency plans to prepare for and respond to such 
an attack. These water systems serve 91 percent of the United States' 
population. Each community's water system is required to conduct a 
vulnerability assessment and submit a copy of the assessment to EPA. 15 
The act specifies that the vulnerability assessment is exempt from 
disclosure under the Freedom of Information Act, except for the identity 



The Technical Service Center provides field inspection personnel with technical 
assistance, advice, and guidance regarding the implementation of national policies, 
programs, and procedures. The center also serves as a central point for reporting and 
responding to suspicious activities related to food security. 

15 The vulnerability assessment must include, among other things, a review of pipes and 
constructed conveyances; physical barriers; and water collection, pretreatment, treatment, 
storage, and distribution facilities. 
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of the community water system and the date on which it certifies 
compliance. Community water systems are also required to prepare an 
emergency response plan that incorporates the results of their 
vulnerability assessments. In addition, the act authorizes funding for 
financial assistance to community water systems to support the 
purchasing of security equipment, such as fencing, gating, lighting, or 
security cameras. 



Food Processors Are 
Implementing a Range 
of Security Measures, 
but Extent of 
Implementation Is 
Largely Unknown to 
FDA and FSIS 



FDA and FSIS lack comprehensive information on the extent to which 
food-processing companies are adopting security measures. However, 
officials from the majority of the food trade associations that we contacted 
believe that their members are implementing a range of measures to 
enhance security at their facilities. We found that the five food-processing 
facilities we visited in various geographic regions around the country are 
also implementing an array of security measures that range from 
developing risk assessment plans to hiring security contractors. 16 
Furthermore, our survey of FDA and FSIS inspectors indicates that, 
generally, food-processing facilities are implementing a range of security 
measures. The survey responses indicate, however, that the inspectors 
were more aware of those security measures that were the most visible to 
them during the course of their regular food safety inspections. 17 



Trade Association Officials According to trade association officials, food processors are voluntarily 



Indicate That Industry Is 
Implementing Various 
Security Measures 



taking steps to prevent the deliberate contamination of their products, 
including adopting many of the measures suggested by FDA and FSIS, 
such as installing fences, requiring that employees wear identification, and 
restricting access to certain plant areas. Association officials told us that 
most large food-processing facilities already have ample security plans 
that include many of the recommendations made by FDA and FSIS. One 
trade association recently conducted a survey of its members and asked 
for their opinions about FSIS's Guidelines. Most of the respondents 



The facilities vary in size from 100 to 800 employees. 

17 We surveyed 50 FSIS Circuit Supervisors (obtained responses from 45) who oversee the 
activities of the agency's field inspectors and 150 FDA investigators (obtained responses 
from 128) who perform the inspections of food-processing facilities to ask about the 
security measures they have observed at the plants they inspect. Our survey included 
questions about outside security, visitor access, employee screening, and shipping and 
handling, among others. The methods used and results from these surveys are contained in 
appendixes II and III. 
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indicated that they were aware of the guidelines; they believed the 
guidelines were for the most part practical and workable; and they used 
them in their security plans. However, these officials were unable to 
provide data on the extent to which the food-processing industry is 
implementing security measures to prevent or mitigate the potential 
deliberate contamination of food products. 18 

Trade association officials also said that they provided FDA and FSIS with 
comments on the voluntary guidelines and, in some cases, have also issued 
their own food security guidelines to their members. Although the officials 
generally believe that the agencies' guidelines are reasonable, they do not 
want the government to regulate food security. They also feel that some 
companies, especially small facilities with limited resources, are unable to 
implement all the measures in the guidelines. Therefore, these officials 
believe it is important for the guidelines to remain voluntary. 

The industry is involved in improving food security in other ways as well. 
For example, the food industry associations formed the Alliance for Food 
Security to facilitate the exchange of information about food security 
issues. The Alliance is composed of trade associations representing the 
food chain, from commodity production through processing, packaging, 
distribution, and retail sale, as well as government agencies responsible 
for food and water safety, public health, and law enforcement. Similarly, 
led by the Food Marketing Institute, the food industry and FBI established 
the Information Sharing and Analysis Center (ISAC), which serves as a 
contact point for gathering, analyzing, and disseminating information 
among companies and the multiagency National Infrastructure Protection 
Center based at FBI headquarters. Through ISAC, FBI officials have 
notified food manufacturers of warnings and threats that the Center deems 
to be credible. ISAC also provides a voluntary mechanism for reporting 
suspicious activity in a confidential manner and for developing solutions. 



Five Processing Facilities 
Provide Some Indication 
about Industry's Efforts 



We visited five food-processing facilities, including a slaughter plant and 
facilities that produce beverages and ready-to-eat products. Although 
these facilities are not in any way representative of all food-processing 
plants nationwide, they provide some information about the types of 



The National Food Processors Association is in the process of evaluating the results from 
its food security survey of its members, but not all of the results were ready in time to be 
included in this report. 
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security measures that some facilities are implementing. All five facilities 
had conducted risk analyses and, on the basis of the results, had 
implemented a number of security measures similar to those suggested in 
the FDA and FSIS guidelines. For example, all five facilities limited access 
to the facility through such means as requiring visitors to enter through a 
guard shack and to provide identification. In addition, employees at three 
of the facilities could enter the facility only by using magnetic cards. 

However, managers at the five facilities offered differing opinions about 
personnel security. Although all of the facilities we visited performed 
background checks on their employees that included verification of social 
security numbers, only some verified prior work experience, criminal 
history, and level of education. One company also required that its 
contractors, such as construction companies working in the facility, 
perform employment, education, and criminal checks of their own 
employees. The facilities also used different protocols for employee access 
to different areas within the plant. For example, at four of the facilities, 
employees were limited to those areas of the plant in which they worked. 

While the managers at these facilities generally complimented FDA's and 
USDA's security guidelines, they said that they do not want the agencies to 
regulate security. Rather, they believe that the agencies should develop a 
nonprescriptive framework or strategy for industry and then leave them to 
decide how to meet their individual requirements. One manager believes 
that food security responsibilities should be moved to the Department of 
Homeland Security. 

Finally, our discussions with trade association officials and food- 
processing industry officials revealed that the industry is very concerned 
about sharing security information with federal agencies because of the 
possibility that it could provide a road map for terrorist groups if it were 
released under the Freedom of Information Act. Although the act exempts 
from public release certain national security, trade secret, and commercial 
or financial information, industry officials are generally skeptical about 
the government's ability to prevent the release of sensitive security 
information at food-processing facilities. FBI officials told us that they 
have cited these exemptions when assuring ISAC members that security 
information shared with them will be protected from public release. These 
officials explained that the courts have generally ruled that the 
commercial information exemption protects those who voluntarily provide 
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the government with information if the information is of a kind that the 
provider would not ordinarily release to the public. 19 However, the FBI 
officials we interviewed believe that the government should find some way 
of assuring industry that sensitive security information is protected from 
public release. 



FDA and FSIS Survey 
Respondents Indicate That 
Processing Facilities Are 
Implementing a Range of 
Security Measures 



FDA and FSIS survey respondents observed a range of security measures 
being implemented at food-processing facilities, although both FDA and 
FSIS respondents were able to provide more information about those 
security measures that were most visible during the course of their normal 
inspection duties. Figure 2 shows selected categories of security measures 
recommended in the FDA and FSIS security guidelines that were most 
visible to inspectors. 20 The majority of the FDA survey respondents said 
they were able to observe security measures, such as fencing around the 
plants' perimeter, limiting access to restricted areas, securing hazardous 
materials, and providing adequate interior and exterior lighting. Likewise, 
most of FSIS's circuit supervisors were able to observe outside security 
measures including alarmed emergency exits, plant perimeter protection, 
positive employee identification, and the inspection of incoming and 
outgoing vehicles. 



See, for example, Critical Mass Energy Project v. Nuclear Regulatory Commission, 975 
F. 2d 871 (D.C. Cir. 1992) (en banc) cert, denied, 507 U.S. 984 (1993) (information in safety 
reports voluntarily provided to the Nuclear Regulatory Commission by nuclear safety 
groups was confidential and thus exempt from disclosure under the Freedom of 
Information Act's exemption for financial or commercial information). 

20 Security measures listed in FDA's and FSIS's food security guidelines are somewhat 
different. The agencies developed their guidelines in January and May 2002, respectively, 
and did not coordinate their efforts. 
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Figure 2: Percentage of Survey Responses Indicating Observation or Knowledge of 
More Visible Security Measures 
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Note: GAO survey of FDA and FSIS inspectors. 
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Survey respondents provided fewer observations regarding other types of 
security measures included in the FDA and FSIS guidelines — in some 
instances because these measures were less visible to them. For example, 
FDA respondents were less able to comment on whether they noticed or 
knew of the presence of security measures designed to account for 
missing stock or for other finished product irregularities. (See fig. 3.) 
Similarly, FSIS respondents were less unable to comment on the extent to 
which facilities were performing background checks on new employees or 
implementing proper mail-handling practices. 
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Figure 3: Percentage of Survey Responses Indicating Observation or Knowledge of 
Less Visible Security Measures 

FDA respondents' observations FSIS respondents' observations 

100 Percentage 100 Percentage 




Source: GAO. 

Note: GAO survey of FDA and FSIS inspectors. 



More than half of FSIS's survey respondents stated that large plants — 
those with at least 500 employees — had implemented a range of security 
measures, including the areas of outside security, storage, slaughter and 
processing, and personnel security. Fewer of these respondents observed 
these security measures at smaller plants. Some FDA and FSIS 
respondents provided additional comments that the very small firms 
typically lack the financial resources to implement many of the security 
measures suggested in the government guidelines. Similarly, some 
respondents commented that many of the security measures might not be 
necessary at smaller establishments. 

Additionally, most of the FDA respondents reported that they had not 
received training on food security; while nearly all of the FSIS respondents 
reported that they had recently received such training. Some of the FSIS 
respondents further stated that although they had received food security 
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training, further training was greatly needed in the field. Such training 
would be beneficial because field personnel are encouraged to discuss 
security measures with managers at the facilities they inspect. 

Finally, responses to our survey showed that FDA and FSIS respondents 
have different levels of "satisfaction" with or "confidence" in the efforts of 
the processing facilities they inspect to ensure the protection of food from 
acts of deliberate contamination. 21 While nearly half of the FSIS 
respondents said they were somewhat or very confident of the efforts 
made by the food processors they inspect, slightly over one-fourth of the 
FDA respondents were satisfied or very satisfied with the efforts made by 
the food processors they inspect. 



Regulatory Officials from 
1 1 States Indicate Some 
Level of Satisfaction with 
Security Efforts 



Thirty-seven food regulatory officials interviewed by state auditors in 11 
states provided opinions on their overall level of satisfaction with federal, 
state, and industry efforts to protect food from intentional contamination. 
Table 1 shows that nearly half of the state regulatory officials interviewed 
expressed satisfaction with the efforts made by federal, state, and industry 
to safeguard food products — though these results cannot be generalized to 
all state regulatory officials. 



FDA preferred that we ask about the level of "satisfaction," while FSIS wanted us to ask 
about the level of "confidence." 
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Table 1 : State Officials' Satisfaction with Federal, State, and Industry Efforts to Safeguard Food Products from Deliberate 
Contamination 


Questions asked of 37 state food safety 
regulatory officials 
(1 1 states) 


Percentage of officials 
very satisfied or 
satisfied 


Percentage of officials 
neither satisfied nor 
dissatisfied 


Percentage of officials 
dissatisfied or very 
dissatisfied 


How satisfied are you with the federal 
government's efforts? 


43.3 


32.4 


24.3 


How satisfied are you with the state 
government's efforts? 


56.8 


29.7 


13.5 


How satisfied are you with industry's efforts? 


43.2 


45.9 


10.8 



Source: State audit offices. 

Notes: Combined state survey of 37 state regulatory officials. 
Percentages may not total 100 because of rounding. 



Finally, most of the state officials interviewed by state auditors believed it 
was either "important" or "very important" for states to monitor whether 
companies have adopted security measures to prevent acts of deliberate 
contamination; 3 of the 11 states are already requiring their inspectors to 
do so. 



The vulnerability of the food supply to potential acts of deliberate 
contamination is a national concern. The President addressed this concern 
in the October 8, 2001, executive order establishing the Office of 
Homeland Security and adding the agriculture and food industries to the 
list of critical infrastructure systems needing protection from terrorist 
attack. The National Academies have also concluded in a recently released 
report that infectious agents and toxic chemicals could be used by 
terrorists to contaminate food-processing facilities. Among other things, 
the report says that FDA should act promptly to extend its Hazard Analysis 
and Critical Control Point methodology so it might be used to deal 
effectively with deliberate contamination of the food supply. The Centers 
for Disease Control and Prevention also reported recently on the need to 
better protect our nation's food and water supplies. 

These assessments underscore the need to enhance security at food- 
processing facilities. Although FDA and FSIS recognize that need and have 
taken action to encourage food processors to voluntarily adopt security 
measures, these actions may be insufficient. Because the agencies believe 
that they generally lack authority to mandate security measures and are 
concerned that such information would be subject to Freedom of 
Information Act requests, they do not collect information on industry's 



Conclusions 
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voluntary implementation of security measures. The agencies are, 
therefore, unable to determine the extent to which food processors have 
voluntarily implemented such measures. Both FDA and USDA have 
completed risk assessments. However, without the ability to require food- 
processing facilities to provide information on their security measures, 
these federal agencies cannot fully assess industry's efforts to prevent or 
reduce the vulnerability of the nation's food supply to deliberate 
contamination. Similarly, they cannot advise processors on needed 
security enhancements. Furthermore, lacking baseline information on the 
facilities' security condition, the agencies would be unprepared to advise 
food-processing facilities on any additional actions needed if the federal 
government were to go to a higher threat alert. 

Finally, the lack of security training for FDA food inspectors on the 
voluntary security guidelines issued for food processors and the limited 
number of FSIS inspectors that have so far received training on the 
voluntary security guidelines hamper the inspectors' ability to conduct 
informed discussions regarding security measures with facility personnel 
as they are currently instructed to do. 



In order to reduce the risk of deliberate contamination of food products, 
we are recommending that the Secretary of Health and Human Services 
and the Secretary of Agriculture study their agencies' existing statutes and 
identify what additional authorities they may need relating to security 
measures at food-processing facilities. On the basis of the results of these 
studies, the agencies should seek additional authority from the Congress, 
as needed. 

To increase field inspectors' knowledge and understanding of food 
security issues and facilitate their discussions about the voluntary security 
guidelines with plant personnel, we are also recommending that the 
Secretary of Health and Human Services and the Secretary of Agriculture 
provide training for their agencies' field staff on the security measures 
discussed in the voluntary guidelines. 



We provided FDA and USDA with a draft of this report for their review 
and comment. We received written and clarifying oral comments from 
each agency. The agencies also provided technical comments, which we 
incorporated into the report as appropriate. FDA agreed with our 
recommendation that it provide all food inspection personnel with training 
on security measures. Subsequently, FDA officials told us that the agency 



Recommendations for 
Executive Action 



Agency Comments 
and Our Evaluation 
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did not have an opinion on our recommendation that it study what 
additional authorities it may need relating to security measures at food- 
processing facilities. In its written comments, FDA stated that the report is 
factual and describes accurately the events and actions that FDA has 
taken on food security. FDA also commented that one of the goals of its 
voluntary guidance to industry is to heighten awareness of food security 
practices and that the role of its investigators is first and foremost food 
safety. FDA also said that it does not have sufficient security expertise to 
provide industry with consultation in this area. FDA further commented 
that although HACCP and other preventive controls are appropriate 
measures to enhance food safety, HACCP does not afford similar 
advantages for addressing deliberate contamination, tampering, and/or 
terrorist actions related to the food supply. Our report underscores that 
the role of FDA's investigators is primarily one of food safety. 
Nevertheless, we believe that it is also crucial for cognizant agencies to 
have information about industry's security efforts so that they can assess 
the extent to which the risk of deliberate contamination is being mitigated. 
We also believe that possessing such information is important if it 
becomes necessary to advise food processors on needed security 
enhancements. With regard to HACCP, our report does not take a position 
on the feasibility of using HACCP as a means to control deliberate 
contamination; instead, we report on the opinion of the National 
Academies. FDA's comments are presented in appendix V. 

In its written comments, USDA agreed with the contents of our report. 
Subsequently, USDA's food safety officials confirmed that the agency also 
agrees with the report's recommendations. In its letter, USDA commented 
that it has already conducted a comprehensive risk assessment of the food 
supply without plant security information and that knowing whether a 
plant employed one or several security measures was not needed to assess 
the risk. Our report acknowledges that USDA has conducted a 
comprehensive risk assessment, but we believe that it is crucial for 
cognizant agencies to have information about industry's security efforts so 
that they can assess the extent to which the risk of deliberate 
contamination is being mitigated. USDA's comments are presented in 
appendix IV. 



As agreed with your offices, unless you publicly announce the contents of 
this report earlier, we plan no further distribution until 30 days from the 
report date. At that time, we will send copies to the Secretaries of 
Agriculture and Health and Human Services; the Director of the Federal 
Bureau of Investigation; the Director, Office of Management and Budget; 
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and other interested parties. We will also make copies available to others 
upon request. In addition, the report will be available at no charge on the 
GAO Web site at http://www.gao.gov. 

If you have any questions about this report, please contact Maria Cristina 
Gobin or me at (202) 512-3841. Key contributors to this report are listed in 
appendix VI. 




Lawrence J. Dyckman 
Director, Natural Resources 
and Environment 
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Appendix I: Scope and Methodology 



To determine the extent to which the current federal food safety statutes 
can be effectively used to regulate security at food-processing facilities, 
we analyzed the Food and Drug Administration's (FDA) and the U.S. 
Department of Agriculture's (USD A) existing statutory authorities. We 
discussed these authorities with FDA and USDA counsel and requested a 
legal opinion to determine the extent to which each agency believes its 
existing authorities allow it to regulate food security. We then 
independently reviewed these authorities to draw our own conclusions. 

To describe the actions that FDA and USDA have taken to help food 
processors prevent or reduce the risk of deliberate food contamination, 
we met with staff from FDA and FSIS to review the voluntary guidelines 
issued by each agency. To better understand the provisions of the 
guidelines, we met with agency program staff responsible for issuing the 
guidelines and for receiving industry comments on it. To learn how the 
guidelines would be implemented, we met with FDA and USD As Food 
Safety and Inspection Service (FSIS) officials responsible for field 
operations and with staff from field offices in Atlanta, Georgia, and 
Beltsville, Maryland. Finally, to gather additional information about the 
vulnerability of the food supply to acts of deliberate contamination, we 
contacted nine experts from academia, including experts in food safety 
and in bioterrorism. 

To describe how the government is determining the extent to which food- 
processing companies are implementing security procedures, we asked 
FDA and FSIS program officials about the nature of the information they 
are collecting about industry security measures. We also conducted 
surveys of agency field personnel to obtain their observations about and 
knowledge of food security measures taken at facilities they regularly 
inspect for food safety. Our FDA survey, which was Web-based, was 
administered to all 150 field investigators who recorded 465 or more hours 
for domestic food inspection from June 1, 2001 to May 31, 2002. Our 
survey of FSIS staff was a telephone survey of a randomly selected 
stratified sample of 50 circuit supervisors. Our response rate for these 
surveys was higher than 85 percent for FDA and 90 percent for FSIS, and 
respondents included participants from all the agencies' geographic 
regions. Before administering the surveys, we discussed with and obtained 
input from FDA and FSIS program officials. We also pretested the surveys 
at field locations to ensure that our questions were valid, clear, and 
precise and that responding to the survey did not place an undue burden 
on the respondents. In addition, we contacted state audit offices in all 50 
states to collect information about state government actions designed to 
prevent the deliberate contamination of food products. Of the 50 state 
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Appendix I: Scope and Methodology 



audit offices we contacted, only 11 agreed to help us collect this 
information: Arizona, Florida, Maryland, Michigan, New York, North 
Carolina, Oklahoma, Oregon, Pennsylvania, Tennessee, and Texas. 

To determine the extent to which the food-processing industry is 
implementing security measures to better protect its products against 
deliberate contamination, we contacted officials from 13 trade 
associations representing, among others, the meat and poultry, dairy, egg, 
and fruits and vegetables industries and the food-processing industry. We 
discussed the guidelines that their organizations have issued, and they 
described what actions their constituents are taking to protect their 
products. We also visited five food-processing facilities in various 
geographic regions to ask corporate and plant officials about the actions 
they have taken to protect their products and facilities against intentional 
contamination. These facilities included a slaughter plant as well as 
facilities that produce beverages and ready-to-eat products. We recognize 
that the efforts of these five facilities are not necessarily representative of 
the whole food-processing industry. To identify the concerns that the 
industry has about sharing sensitive information with federal agencies, we 
spoke with industry representatives as well as officials from the Federal 
Bureau of Investigation's National Infrastructure Protection Center. 

We conducted our review from February through December 2002 in 
accordance with generally accepted government auditing standards. 
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Appendix II: FDA Survey Results 



We surveyed the full census of eligible FDA investigators using a web-based survey. We 
considered investigators who had billed at least half of their time in the inspection of food 
facilities to be eligible for this census. This yielded 152 investigators who billed 465 or more 
hours in domestic food inspection between June 1, 2001 and May 31, 2002. Two investigators 
were randomly selected from the field to participate in the pre-testing development of the web- 
based survey instrument. Of the remaining 150 investigators, 128 surveys were completed 
between September 1 1, 2002 and October 15, 2002 for an overall response rate of 85%. All of 
the percentage estimates from the FDA survey shown in the results reported below have 
sampling errors of +/- 3.3 percentage points or less (unless otherwise noted) with a 95% level of 
confidence, and illustrate the possible variability in the responses due to the survey non-response 
rate. The completed interviews included food investigators from all FDA regions (Table 1). 



Table 1 Com pleted FDA Investigator Surveys by Field Office 



Field Office 


Web Surveys 


Total 


Complete*] 


Not 
completed 


Atlanta 


2 


3 


5 


Baltimore 


4 




4 


Chicago 


6 




6 


Cincinnati 


2 


1 


3 


Dallas 


7 




7 


Denver 


3 


1 


4 


Detroit 


7 


2 


9 


Florida 


8 


2 


10 


Kansas City 


2 




2 


Los Angeles 


3 


2 


5 


Minneapolis 


14 


3 


17 


New England 


14 




14 


New Jersey 


8 


1 


9 


New Orleans 


13 


1 


14 


New York 


5 


2 


7 


Philadelphia 


5 


1 


6 


San 
Francisco 


11 


1 


12 


Seattle 


14 


2 


16 


TOTAL 


128 


22 


150 
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FDA Web Survey 

When we use the phrase "food security" in this survey, we specifically mean any security measures that address the protection of 
the food supply from acts of deliberate contamination. Measures designed to protect the food supply from deliberate 
contamination may involve the physical security inside and outside of food processing facilities; the handling of raw materials, 
packaging, and finished products; the management of personnel; or measures that are specific to in-house laboratories. 

We understand that FDA's Food Security Preventive Measures Guidance (referred to as "the Guidance" throughout the survey) is 
voluntary for the industry. Your response to these questions will in no way be used to assess your performance. If there are any 
questions in this survey that you prefer not to answer, just skip to the next question. 



Some response percentages for survey items do not add up to 100% due to item non-response, or cases where individuals left an 
item blank. 



This section includes some questions about your roles and responsibilities 
with regard to food security and the protection of the food supply from acts of 
deliberate contamination. In May 2002, FDA issued field instructions 
describing how food regulatory officials are to use the Guidance during 
regular inspections/audits of food establishments. First, we'd like to ask some 
general questions about the Guidance. 


Yes 


No 


Have you had the opportunity to read the Guidance ? 
n=128 


90.6% 


9.4% 


How often have you provided the Guidance to at least one private sector 

official at each plant during your inspections? 

n=127 


60.2 % All the time 
15.6% Most of the time 
2.3 % About half the time 
7.0 % Some of the time 
11.7% Rarely or Never 
2.3 % No basis to judge 


To what extent, if at all, have your roles and responsibilities changed as a 

result of the Guidance? Have they changed to a: 

n=126 


0.0 % Very great extent 
2.3 %Great extent 
18.0% Moderate extent 
39.1 % Some extent 
34.4 % Little or no extent 
4.7 % No basis to judge 


Please check any of the following new roles and responsibilities that apply to 
you since the Guidance was issued: (Check all that apply.) 


Percent that checked item 


Look for the presence of the security measures mentioned in the Guidance 
when I am inspecting food facilities. n=128 


36.7% 


Conduct informal conversations with plant operators on security issues. 

n=128 


47.7% 


Spend more time becoming familiar with food security issues (for example, 
by talking with other agency officials, looking up material on the WEB, etc.). 

n=128 


14.8% 


Informally discuss food security issues with my supervisor or with other 

investigators. n=128 


16.4% 


Other new roles and responsibilities (please specify below), n-128 


3.1% 


No new roles and responsibilities as a result of the new Guidance. n=128 


0.8% 


Have you received any training with regard to the new food security 
Guidance? n=127 


Yes 


No 


Other 


14.8% 


77.3% 


7.0% 


Have you been informed that you will receive training in the future with 
regard io the new food security Guidance? n=126 


8.6% 


86.7% 


3.1% 


To what extent do you understand your roles and responsibilities relative 
to the new food security Guidance? Do you understand your roles and 
responsibilities to a: 
n=124 


7.8 % Very great extent 
2 1.9% Great extent 
27.3 % Moderate extent 
19.5 % Some extent 
17.2 % Little or no extent 
3. 1 % Other 
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In this section, we'd like to ask you some questions about security 
measures that you may have seen at food facilities that you inspect. We 
understand that FDA's Guidance is voluntary for the industry. Nevertheless, 
we are interested in knowing what security measures listed in the Guidance 
you may have noticed in the food facilities that you inspect. If you haven't 
noticed these security measures, that's OK. Your responses to these questions 
will in no way be used to assess your performance. We are not asking for a 
comparison of security measures that are in place before and after the events 
of September 11, 2001. We would like your professional judgment about 
security measures you know about or have noticed in food facilities regardless 
of when they were put in place. 




First, we would like to ask you a little background information on your 

experience as an FDA investigator. 

How long have you been an FDA investigator? 

n=128 


18.0% 1 to 3 years 
32.0 % 4 to 7 years 
27.3 % 8 to 12 years 
22.7 % 13 years or longer 


Approximately how many food processing facilities (including warehouses, 
commissaries, etc.) have you inspected during the last 12 months? 
n=128 


0.8 % facilities 

10.2 % 1 to 12 facilities 
21.9 % 13 to 24 facilities 
39.8 % 25 to 36 facilities 

20.3 % 37 to 60 facilities 
7.0 % 61 or more facilities 


Are you an Interstate Travel Program Specialist (ITPS, formerly Interstate 
Travel Specialist)? n=128 


Yes 


No 


10.9% 


89.1% 


Let's start with physical security. Please focus on the physical security 
measures suggested in the Guidance. Based on your visits to the food 
facilities that you have inspected in the past 12 months, have you had the 
opportunity to notice or otherwise be aware of the following physical security 
measures: 


Yes 


No 


No basis to 
judge 


Perimeter access protection, such as fencing? 

n=126 


73.4% 


20.3% 


4.7% 


Limited access to restricted areas? 

n=126 


77.3% 


14.8% 


6.2% 


Adequate interior and exterior lighting? 

n=125 


78.1% 


10.2% 


9.4% 


Any other physical security measures in the food facilities that you inspect? 

n=116 


39.1% 


40.6% 


10.9% 


In general, for the food facilities that you have inspected, how many have 

physical security measures like the ones you just indicated? 

n=128 


3.9 % All of them 
20.3 % Almost all of them 
45.3 % Some of them 
24.2 % Few of them 
2.3 % None of them 
3.9 % No basis to judge 


Now we'd like to turn your attention to the section of the voluntary guidance 
related to the packaging and handling of raw materials. Based on your visits 
to the food facilities that you have inspected in the past 12 months, have you 
had the opportunity to notice or otherwise be aware of the following 
packaging and handling of raw materials measures: 


Yes 


No 


No basis to 
judge 


Supervision of off-loading of incoming ingredients, packaging, and labels? 

n=127 


60.9% 


29.7% 


8.6% 


Destruction of outdated or discarded product labels? 

n=127 


21.9% 


62.5% 


14.8% 


Investigation of packaging or paperwork irregularities associated with the 

receipt of ingredients? n=127 


30.5% 


48.4% 


20.3% 


Any other security measures related to the packaging and handling of raw 
materials in the food facilities that you inspect? n=I 1 1 


18.8% 


52.3% 


15.6% 


In general, for the food facilities that you have inspected, how many have 
security measures related to the packaging and handling of raw materials like 
the ones you just indicated? 
n=127 


2.3 % All of them 
18.8% Almost all of them 

31.2 % Some of them 

20.3 % Few of them 
15.6% None of them 
10.9 % No basis to judge 
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Now we'd like you to think about the section of the voluntary guidance related 

inspected in the past 12 months, have you had the opportunity to notice or 
otherwise he aware o\ the loilowin° inside security measures - 


Yes 


No 


No basis to 
judge 


Monitoring of the quality of water sources? 

n=128 


64.8% 


30.5% 


4.7% 


Monitoring of the security of water sources? 

n=128 


19.5% 


68.0% 


12.5% 


Monitoring of the quality of air sources? 

n=127 


16.4% 


71.9% 


10.9% 


Monitoring of the security of air sources? 

n=127 


4.7% 


80.5% 


14.1% 


Securing storage areas for hazardous chemicals' 7 
n=127 


81.2% 


13.3% 


4.7% 


Limiting access to hazardous chemicals storage areas? 

n=128 


68.0% 


26.6% 


5.5% 


Any other measures addressing inside security in the food facilities that you 

inspect? n=108 


13.3% 


55.5% 


15.6% 


In general, for the food facilities that you have inspected, how many have 

inside security measures like the ones you just indicated? 

n=126 


3.1 % All of them 
3 1 .2 % Almost all of them 
32.8 % Some of them 
21.1 %Few of them 
7.8 % None of them 
2.3 % No basis to judge 


Next we'd like you to think about the section of the voluntary guidance related 
to finished products. Based on your visits to the lood facilities that you have 
inspected in the past 12 months, have you had the opportunity to notice or 
otherwise be aware oi the lollowing finished products measures - 


Yes 


No 


No basis to 
judge 


Investigation of missing or extra stock, or any other irregularities? 

n=128 


18.0% 


59.4% 


22.7% 


Random inspections of storage facilities, vehicles, and product containers? 

n=128 


48.4% 


39.8% 


11.7% 


Locking and sealing vehicles, containers, or rail cars? 

n=128 


52.3% 


32.8% 


14.8% 


Any other measures addressing the security of finished products in the food 
facilities that you inspect? n=104 


7.0% 


53.9% 


20.3% 


In general, for the food facilities that you have inspected, how many have 
security measures for finished products like the ones you just indicated? 
n=128 


2.3 % All of them 
17.2 % Almost all of them 
34.4 % Some of them 
17.2 % Few of them 
18.0% None of them 
10.9 % No basis to judge 


Now please take a moment to think about the section of the voluntary 
guidance related to personnel at food production facilities. We are aware that 
FDA is currently revising the Guidance sections addressing the process for 
performing criminal background checks and reviewing immigration status. 
However, we'd like to ask some general questions about personnel security in 
the food facilities you have visited. Based on your visits to the food facilities 
that you have inspected in the past 12 months, have you had the opportunity 
to notice or otherwise be aware of the following personnel security measures: 


Yes 


No 


No basis to 
judge 


A system of positive ID and recognition (for example issuing photo IDs or 

color-coding badges)? n-128 


60.9% 


32.0% 


7.0% 


Limiting employee access to certain parts of the plant? 

n=128 


61.7% 


32.0% 


6.2% 


Restricting the personal items that are allowed in the plant? 

n=128 


63.3% 


25.0% 


11.7% 


Providing food security training to all or some employees? 

n=128 


34.4% 


47.7% 


18.0% 


Any other general personnel security measures in the food facilities that you 

inspect? n=104 


9.4% 


53.1% 


18.8% 
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In general, for the food facilities that you have inspected, how many have 
genera! personnel security measures like the ones you just indicated? 
n=127 


5.5% All of them 
18.8 % Almost all of them 
35.2 % Some of them 
28.9% Few of them 
5.5 % None of them 
5.5 % No basis to judge 


Now we'd like to ask some questions about the section of the voluntary 
guidance related to in-house plant laboratories. 


Yes 


No 


No basis to 
judge 


First, have you inspected any food processing food facilities with an in-house 
laboratory (used for water or bacterial testing, for instance) in the past 12 
months? n=127 


64.1% 


35.2% 




Based on your visits to the food facilities that you have inspected in the past 
12 months which had an in-house lab, have you had the opportunity to notice 
or otherwise be aware of the following in-house laboratory measures: 
Note: Respondents who answered 'No ' to the previous question are included 
tn the next four items in the "No basis io judge" category. 








Restricting access to the laboratory and to sensitive materials? 

n=128 


41.4% 


21.1% 


37.5% 


Restricting laboratory materials to the laboratory? 

n=128 


39.8% 


15.6% 


44.5% 


Any other in-house plant laboratory security measures in the food facilities 

that you inspect? n=108 


4.7% 


35.2% 


44.5% 


In general, for the food facilities that you have inspected, how many have in- 
house plant laboratory security measures like the ones you just indicated? 
n=125 


7.0% All of them 
9.4 % Almost all of them 
11.7 % Some of them 
18.0% Few of them 
12.5 % None of them 
39. 1 % No basis to judge 


Now please think about sections of the voluntary guidance related to general 
security. Based on your visits to the food facilities that you have inspected in 
the past 12 months, have you had the opportunity to notice or otherwise be 
aware of the following general security measures: 


Yes 


No 


No basis to 
judge 


Restricting access to the plant's critical data systems to those with appropriate 

clearance? n=128 


60.2% 


19.5% 


20.3% 


Restricting entry to the establishment, especially food handling and storage 

areas? n— 128 


71.9% 


22.7% 


5.5% 


Monitoring areas that may be vulnerable to tampering? 

n=128 


37.5% 


50.0% 


12.5% 


Encouraging all staff to be alert for any signs of tampering with products or 

equipment? n=128 


38.3% 


40.6% 


21.1% 


Any other general security measures in the food facilities that you inspect? 

n=100 


3.9% 


56.2% 


18.0% 


In general, for the food facilities that you have inspected, how many have 

general security measures like the ones you just indicated? 

n=127 


4.7 % All of them 

28.9 % Almost all of them 
25.8 % Some of them 
25.0 % Few of them 
7.0 % None of them 

7.8 % No basis to judge 


Keeping in mind the food security measures you have just indicated in your 
answers on the survey: How satisfied are you with the efforts of these food 
facilities to ensure the protection of food processed in the United States from 
acts of deliberate contamination? 
n=128 


3.9 % Very satisfied 
25.0 % Satisfied 

34.4 % Neither satisfied nor dissatisfied 
26.6 % Dissatisfied 

7.0 % Very dissatisfied 

3.1 % No basis to judge 
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We randomly selected a stratified sample of 50 USDA circuit supervisors based on a probability 
procedure to assure that the sample was representative of all circuit supervisors (149) and USDA 
circuits (15). (Two additional circuit supervisors were randomly selected from the field to 
participate in the pre-testing development of the survey instrument.) Our sample is one of a 
number of samples that we might have drawn from the total population of USDA circuit 
supervisors, with potentially different results. We express our confidence in our particular 
results as 95 percent confidence intervals — bounded by lower and upper confidence limits. 
These are intervals that would contain the actual population values for 95 percent of the samples 
we could have drawn, and are shown in parentheses following the weighted results of the USDA 
survey below. We can say we are 95 percent confident that each of the confidence intervals 
presented in this report include the true values in the study population. We completed 45 
surveys using a computer-assisted telephone interviewing method for an overall response rate of 
90% between September 30, 2002 and October 9, 2002. The completed interviews included 
circuit supervisors from all USDA circuits (Table 1). 



Table 1 Completed USDA Circuit Supervisor Interviews by C ircuit 



Circuit 


Interviews 


Total 


Completed 


Not 
Completed 


Alameda 


4 





4 


Albany 


2 


1 


3 


Atlanta 


4 


1 


5 


Beltsville 


2 





2 


Boulder 


4 





4 


Chicago 


2 


2 


4 


Dallas 


3 





3 


Des Moines 


3 





3 


lackson 


4 





4 


Lawrence 


2 





2 


Madison 


2 


1 


3 


Minneapolis 


2 





2 


Philadelphia 


4 





4 


Raleigh 


4 





4 


Springdale 


3 





3 


TOTAL 


45 


5 


50 



USDA Telephone Interview 



Good morning/afternoon. Thank you for taking the time to call today. My name is [ ] and I will be speaking with you today 
about the types of security practices that you may have noticed at the food processing plants that in your circuit as well as your 
roles and responsibilities with respect to food security. 

Let me tell you a little about the survey. FSIS management has participated in the development of the survey. GAO understands 
that the FSIS Security Guidelines for Food Processors are voluntary for the industry. Your responses to these questions will in no 
way be used to assess your performance and your name will not be disclosed. If you have not witnessed or have no knowledge of 
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a particular security measure I mention in this survey, it is no problem - simply answer, "1 don't know" and we'll move on to the 
next question. Do you have any questions before we begin? 

Since it is important that we follow the format for the rest of our interview, please hold any other questions or comments until the 
survey is completed. 



Note: Some response percentages for survey items do not add up to 100% due to item non-response, where individuals did not 
respond to an item. 



Let's begin the first section of the survey on your food security roles and 
responsibilities. Have you received any training with regard to the new food 
security guidelines? 


Yes 


No 


Other 


93.2% 
(81.8, 98.5%) 


4.6% 
(0.6, 15.2%) 


2.2% 
(0.1, 11.5%) 


Do you expect to receive any training in the future regarding the new food 
security guidelines? 


67.4% 
(52.0, 80.5%) 


11.1% 

(3.7, 23.8%) 


21.5% 
(10.8, 36.1%) 


In September 2001, all FSIS field personnel were asked to be on heightened 
alert in identifying and reporting suspicious activities. We are interested in 
your understanding of what it means to be on heightened alert. As I read the 
following items, please tell me if they reflect your understanding of being 
placed on heightened alert or not by responding "Yes" or "No." You may 
select any of the items from the list that apply. 


Yes 


No 


No answer/ 
Did not reply 


Report suspicious activity to the Technical Center. 


86.4% 
(73.7, 94.4%) 


2.0% 
(0.1, 10.7%) 


2.0% 
(0.1, 10.7%) 


Report suspicious activities that you feel have occurred or are in progress to 
tile local law enforcement authorities. 


86.6% 
(74.0, 94.6%) 


1.8% 
(0.1, 10.6%) 


0.0% 
(0.0, 5.8%) 


Report suspicious activities to plant management. 


78.22% 
(64.3, 88.6%) 


7.95% 
(2.2, 19.2%) 


4.25% 
(0.6, 14.1%) 


Report suspicious activities to your supervisor. 


93.5% 
(82.2, 98.7%) 


4.5% 
(0.6, 15.0%) 


2.0% 
(0.1, 11.5%) 


Do you have any other understanding of being placed on heightened alert? 


52.6% 
(41.1,64.1%) 


37.7% 
(24.4, 52.5%) 


0.0% 
(0.0, 5.8%) 


Has your circuit experienced any incidents of possible bio-terrorism that were 
reported to local authorities? 


12.3% 
(4.5, 25.3%) 


87.7% 
(74.7, 95.5%) 






How many incidents in your circuit were reported to local authorities? 


6 circuit supervisors reported 1 incident in their circuit. 


To what extent, if at all, have your responsibilities changed since the issuance 
of the FSIS Security Guidelines for Food Processors? Have your 
responsibilities changed to a: 


1.9% Very great extent (0.1, 1 1.5%) 
24.3% Great extent (12.9, 39.2%) 
40.4% Moderate extent (26.2, 55.9%) 
28.8% Some extent (16.4, 44.0%) 
4.6% Little extent (0.6, 15.2%) 
0.0% Not at all (0.0, 6.3%) 
0.0% No basis to judge (0.0. 6.3%) 


Please briefly describe how your responsibilities have changed to a [ ] 
extent. 






To what extent do you understand your roles and responsibilities relative to 
the new food security Guidance? Do you understand your roles and 
responsibilities to a: 


12.5% Very great extent (4.6, 25.6%) 
45.2% Great extent (30.5, 60.5%) 
26.0% Moderate extent (14.2, 41.1%) 
16.3% Some extent (7.1, 30.2%) 
0.0% Little extent (0.0, 6.3%) 
0.0% Not at all (0.0, 6.3%) 
0.0% No basis to judge (0.0, 6.3%) 


Now I have some questions about the plants that are in your circuit. 

About how many plants are in your circuit? 


Responses ranged from 7 to 136 (mcdian=30.0) 


About how many of these plants are large, with 500 or more employees? 


Responses ranged from to 13 (median=4.0) 


About how many of these plants are small, with between 1 1 and 499 

employees? 


Responses ranged from to 95 (median=10.0) 


About how many of these plants are very small, with less than 1 1 employees? 


Responses ranged from to 98 (median^ 1 1 .0) 


Thank you for the background information. Now, let's begin a discussion of 
security measures. I will cover ten areas of a plant where security measures 
are recommended according to the FSIS food security guidelines. Again, we 
realize that these security measures are voluntary and that you are not 
required to monitor or enforce them. For each area, I will list several specific 
security measures suggested in the guidelines. Please tell me whether you 


Yes 


No 


Don '1 Know/ 
Cannot Say 
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have had the opportunity to notice or otherwise be aware of each security 
measure based on the plants in your circuit. We are not asking for a 
comparison of security measures that were in place before and after the events 
of September 11, 2001. We would like your professional judgment about 
security measures you know about or have noticed in plants regardless of 
when they were put in place. 

Let's start with the area of outside security. Based on your knowledge and 
observations in the plants in your circuit, have you had the opportunity to 
notice or otherwise be aware of the following outside security measures? 








Monitoring the integrity of the plant perimeter to prevent unauthorized entry? 


95.6% 
(85.1,99.5%) 


4.4% 
(0.5, 14.9%) 


0.0% 
(0.0, 6.3%) 


Alarmed emergency exits? 


88.8% 
(75.9, 96.1%) 


6.9% 
(1.5, 18.4%) 


4.4% 
(0.5, 14.9%) 


Positive identification for entry? 


86.9% 
(74.3, 94.8%) 


3.8% 
(0.4, 13.4%) 


0.0% 
(0.0, 5.8%) 


The protection of shipping and receiving areas? 


73.6% 
(58.5, 85.5%) 


21.8% 

(11.0,36.5%) 


4.5% 
(0.6, 15.1%) 


An updated list of plant personnel with open/restricted access 
maintained at security office? 


37.1% 
(23.3, 52.6%) 


33.1% 
(20.0, 48.5%) 


29.8% 
(17.2,45.1%) 


The inspection of all incoming and outgoing vehicles? 


78.5% 
(63.9, 89.2%) 


17.1% 
(7.6, 31.1%) 


4.4% 
(0.5, 14.9%) 


The verification of truck deliveries? 


76.7% 
(61.9, 87.9%) 


10.3% 
(3.3, 22.9%) 


13.0% 
(4.9, 26.2%) 


Monitoring of hazardous materials or water supply storage tanks? 


57.5% 
(42.1,72.0%) 


17.7% 
(8.0,31.7%) 


24.8% 
(13.3,39.8%) 


Do you know of any other outside security measures in the plants in your 

circuit? 


43.4% 
(34.2, 52.5%) 


46.8% 
(37.1,56.6%) 


0.0% 
(0.0, 5.8%) 


In general how many of the LARGE plants in your circuit would you say 
have implemented these outside security measures? 


63.3% All of them (47.8, 77.0%) 

13.7% Almost all of them (5.4, 27. 1%) 

7.7% Some of them (1.9, 19.5%) 

4.2% Few of them (0.5, 14.6%) 

0.0% None of them (0.0, 6.3%) 

0.0% Don't know/ Cannot say (0.0, 6.3%) 

11.1% Does not apply (3.7, 23.8%) 


In general, how many of the SMALL plants have implemented these outside 
security measures? 


9. 1 % All of them (2.6, 21 .3%) 

11.6% Almost all of them (4.0, 24.4%) 

21 .6% Some of them (10.8, 36.2%) 

49.5% Few of them (36.5, 62.4%) 

4.2% None of them (0.5, 14.6%) 

0.0% Don't know/ Cannot say (0.0, 6.3%) 

4.2% Does not apply (0.5, 14.6%) 


In general, how many of the VERY SMALL plants have implemented these 
outside security measures? 


4.4% All of them (0.5, 14.9%) 
0.0% Almost all of them (0.0, 6.3%) 
4.2% Some of them (0.5, 14.6%) 
25.8% Few of them (14.1, 40.9%) 
50.7% None of them (39.0, 62.4%) 
0.0% Don't know/ Cannot say (0.0, 6.3%) 
14.9% Does not apply (6.1, 28.5%) 


In general, for the plants you are aware of that have implemented these 
outside security measures, what size plants are they? Are they: (check all that 
apply) 


76.2% Large plants (500 or more employees) (62.0, 87.1%) 
33.5% Small plants (11 - 499 employees) (20.8, 48.3%) 
9.9% Very small plants (< 1 1 employees) (3.3, 21.7%) 
0.0% Don't know/ Cannot say (0.0, 5.8%) 
0.0% Does not apply (0.0, 5.8%) 


Moving to the area of shipping and handling security. Based on your 
knowledge and observations in the plants in your circuit, have you had the 
opportunity to notice or otherwise be aware of the following Shipping and 
Handling Security measures? 


Yes 


No 


Don't Know/ 
Cannot Say 


Tamper proof packaging? 


52.8% 
(37.5, 67.7%) 


30.1% 
(17.5,45.4%) 


17.1% 
(7.6,31.1%) 
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Inspection of suspicious shipping documents? 


39.3% 
(25.8,54.1%) 


23.7% 
(12.8. 37.8%) 


27.5% 
(15.8,41.9%) 


Special arrangements for off-hour deliveries? 


38.8% 
(24.8, 54.3%) 


32.4% 
(19.3, 47.8%) 


28.8% 
(16.4, 44.0%) 


Inspection of incoming shipments for tampering? 


67.7% 
(52.3, 80.7%) 


14.8% 
(6.1,28.3%) 


17.6% 
(7.9,31.6%) j 


Advance notification from suppliers for incoming deliveries? 


38.1% 
(24.2, 53.6%) 


16.5% 
(7.2, 30.4%) 


45.5% 
(30.7, 60.8%) 


Do you know of any other shipping and handling security measures in the 

plants in your circuit? 


19.6% 
(9.4, 34.0%) 


80.4% 
(66.0, 90.6%) 


0.0% 
(0.0, 6.3%) 


In general, how many of the LARGE plants in your circuit would you say 
have implemented these shipping and handling security measures? 


47.8% All of them (32.8, 63.0%) 

26.7% Almost all of them (14.7, 41.8%) 

6.0% Some of them (1.1, 17.1%) 

2.0% Few of them (0.1, 11.5%) 

0.0% None of them (0.0, 6.3%) 

6.5% Don't know/ Cannot say (1.4, 17.9%) 

11.1% Does not apply (3.7, 23.8%) 


In general, how many of the SMALL plants have implemented these shipping 
and handling security measures? 


9.3% All of them (2.8, 21.6%) 
8.5%Almost all of them (2.3, 20.5%) 
22.6% Some of them (1 1.6, 37.3%) 
36.2% Few of them (22.6, 51.7%) 
8.5% None of them (2.3, 20.6%) 
10.7% Don't know/ Cannot say (3.5, 23.4%) 
4.2% Does not apply (0.5, 14.6%) 


In general, how many of the VERY SMALL plants have implemented these 
shipping and handling security measures? 


8.8% All of them (2.5, 20.9%) 

4.2% Almost all of them (0.5, 14.6%) 

4.9% Some of them (0.7, 15.6%) 

28.6% Few of them (16.3, 43.9%) 

28.1% None of them (15.9, 43.3%) 

10.9% Don't know/ Cannot say (3.6, 23.6%) 

14.5% Does not apply (5.9, 28.0%) 


In general, for the plants you are aware of that have implemented these 
shipping and handling security measures, what size plants are they? Are they: 
(check all that apply) 


76.2% Large plants (500 or more employees) (62.0, 87. 1%) 
33.3% Small plants (1 1 - 499 employees) (20.6, 48.0%) 
22.4% Very small plants (< 11 employees) (11.9, 36.4%) 
8.0% Don't know/ Cannot say (2.3, 19.3%) 
2.0% Does not apply (0.1, 10.7%) 


Now, I'd like for you to think about measures used to address inside security. 
Based on your knowledge and observations in the plants in your circuit, have 
you had the opportunity to notice or otherwise be aware of the following 
Inside Security measures? 


Yes 


No 


Don 't Know/ 
Cannot Say 


Clearly marked and secured restricted areas within the establishment? 


69.3% 
(54.0, 82.0%) 


26.2% 
(14.3,41.2%) 


4.5% 
(0.6, 15.1%) 


Controlled access to centralized airflow, water systems, electricity and gas? 


47.4% 
(32.5, 62.6%) 


35.1% 
(21.6, 50.6%) 


17.5% 
(7.9, 31.5%) 


Airflow systems with provisions for the isolation of contaminated areas? 


23.7% 
(12.4, 38.5%) 


37.0% 
(23.2, 52.5%) 


39.3% 
(25.3, 54.8%) 


An updated plant layout scheme? 


80.1% 
(65.8, 90.4%) 


15.3% 
(6.4, 28.9%) 


4.6% 
(0.6, 15.2%) 


Controlled access to in-plant ice-making equipment? 


28.1% 
(16.3, 42.6%) 


48.0% 
(36.5, 59.4%) 


14.6% 

(6.3, 27.5%) 


Procedures for the regular inspection of water lines used in food processing 

areas? 


43.2% 
(28.7, 58.6%) 


39.6% 
(25.5,55.1%) 


17.2% 
(7.7, 31.2%) 


Controlled access to production or laboratory areas? 


80.2% 
(65.8, 90.5%) 


17.6% 
(8.0, 31.7%) 


2.2% 
(0.1, 11.5%) 


Do you know of any other inside security measures in the plants in your 

circuit? 


30.3% 
(17.6, 45.6%) 


69.7% 
(54.4, 82.4%) 


0.0% 
(0.0, 6.3%) 
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In general, how many of the LARGE plants in your circuit would you say 
have implemented these inside security measures? 


47.9% All of them (32.9, 63.1%) 
18.0% Almost all of them (8.2, 32.1%) 
12.6% Some of them (4.6, 25.7%) 
6.4% Few of them (1.3, 17.7%) 
4.2% None of them (0.5, 14.6%) 
0.0% Don't know/ Cannot say (0.0, 6.3%) 
11.1% Does not apply (3.7, 23.8%) 


In general, how many of the SMALL plants have implemented these inside 
security measures? 


7.1% All of them (1.6, 18.7%) 
2.0% Almost all of them (0. 1 , 1 1 .5%) 
19.4% Some of them (9.2, 33.7%) 
48.2% Few of them (36.6, 59.8%) 
15.1% None of them (6.2, 28.7%) 
0.0% Don't know/ Cannot say (0.0, 6.3%) 
8.2%) Does not apply (2.2, 20.2%) 


In general, how many of the VERY SMALL plants have implemented these 
inside security measures? 


6.1% All of them (1.3, 16.7%) 
0.0% Almost all of them (0.0, 5.8%) 
5.7% Some of them (1.1, 16.1%) 
29.4% Few of them (17.3, 43.9%) 
36.0% None of them (22.9, 50.8%) 
0.0% Don't know/ Cannot say (0.0, 5.8%) 
13.5% Does not apply (5.5, 26.1%) 


In general, for the plants you are aware of that have implemented these inside 
security measures, what size plants are they? Are they: (check all that apply) 


76.2% Large plants (500 or more employees) (62.0, 87. 1%) 
31.2% Small plants (11 -499 employees) (18.9, 45.9%) 
16.4% Very small plants (< 11 employees) (7.5, 29.6%) 
2.0% Don't know/ Cannot say (0.1, 10.7%) 
2.0% Does not apply (0.1, 10.7%) 


Let's talk a little about security measures used to protect storage facilities. 
Based on your knowledge and observations in the plants in your circuit, have 
you had the opportunity to notice or otherwise be aware of the following 
Storage Security measures? 


Yes 


No 


Don't Know/ 
Cannot Say 


Controlled access for all product and ingredient storage areas? 


68.6% 
(53.3,81.5%) 


28.8% 
(16.4,44.0%) 


2.5% 
(0.1, 12.1%) 


Regularly scheduled security inspections? 


31.8% 
(18.9, 47.2%) 


42.0% 
(27.6, 57.5%) 


26.2% 
(14.3,41.2%) 


Daily inventories of hazardous chemicals? 


35.0% 
(21.5,50.5%) 


27.5% 
(15.4, 42.6%) 


37.5% 
(23.7, 53.0%) 


Secured facilities for hazardous chemicals? 


81.2% 
(67.0,91.2%) 


12.5% 
(4.6, 25.6%) 


6.3% 
(1.3, 17.6%) 


Do you know of any other security measures used to protect storage facilities 

in the plants in your circuit? 


14.2% 

(5.9, 26.9%) 


76.3% 
(62.1,87.2%) 


0.0% 
(0.0, 5.8%) 


In general, how many of the LARGE plants in your circuit would you say 
have implemented these storage security measures? 


54.4% All of them (43 .0, 65.9%) 
18.0% Almost all of them (8.6, 3 1 .5%) 
3.9% Some of them (0.4, 13.5%) 
0.0% Few of them (0.0, 5.8%) 
3.9% None of them (0.4, 13.5%) 
0.0% Don't know/ Cannot say (0.0, 5.8%) 
t 10.2% Does not apply (3.5, 22.1%) 


In general, how many of the SMALL plants have implemented these storage 
security measures? 


1 1.2% All of them (3.8, 24.0%) 
12.6% Almost all of them (4.7, 25.7%) 
22.4% Some of them (11.4, 37.1%) 
32.3% Few of them (19.2, 47.7%) 
15.2% None of them (6.3, 28.8%) 
2.2% Don't know/ Cannot say (0.1, 11.5%) 
4.2% Does not apply (0.5, 14.6%) 


In general, how many of the VERY SMALL plants have implemented these 
storage security measures? 


8.5% All of them (2.3, 20.5%) 

I. 9% Almost all of them (0.1, 1 1.5%) 

II. 1% Some of them (3.7, 23.8%) 
33.4% Few of them (20.2, 48.8%) 
30.6% None of them (17.9, 45.9%) 

2.0% Don't know/ Cannot say (0. 1 , 1 1 .5%) 
12.5% Does not apply (4.6, 25.6%) 
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In general, for the plants you are aware of that have implemented these 
storage security measures, what size plants are they? Are they: (check all that 
apply) 


76.2% Large plants (500 or more employees) (62.0, 87 1 %) 
28.2% Small plants (1 1 - 499 employees) (16.4, 42.7%) 
17.8% Very small plants (< 11 employees) (8.5. 31.3%) 
4.0% Don't know/ Cannot say (0.5, 13.8%) 
2.0% Does not apply (0.1, 10.7%) 


Now, please think about security measures used with regard to mail handling. 
Based on your knowledge and observations in the plants in your circuit, have 
you had the opportunity to notice or otherwise be aware of the following Mail 
Handling Security measures'? 


Yes 


No 


Don 't Know/ 
Cannot Say 


Locating mail handling in a facility that is separate from the food production 

operation? 


65.5% 
(50.0, 78.9%) 


17.7% 
(8.1,31.8%) 


16.8% 
(7.4, 30.7%) 


Training mail handlers in the recognition of suspicious mail? 


20.6% 
(10.5, 34.4%) 


23.9% 
(13.0,38.1%) 


45.9% 

(34.7, 57.2%) 


Do you know of any other security measures used with regard to mail 
handling in the plants in your circuit 


16.0% 
(6.9, 29.8%) 


79.7% 
(65.2, 90.1%) 


4.4% 
(0.5, 14.9%) 


In general, how many of the LARGE plants in your circuit would you say 
have implemented these mail handling security measures? 


30.7% All of them (17.9, 46.0%) 

4.2% Almost all of them (0.5, 14.6%) 

15.7% Some of them (6.7, 29.5%) 

12.9% Few of them (4.8, 26.1%) 

6.3%Noneofthem(1.3, 17.6%) 

8.4% Don't know/ Cannot say (2.2, 20.4%) 

21.8% Does not apply (1 1.0, 36.5%) 


In general, how many of the SMALL plants have implemented these mail 
handling security measures? 


8.0% All of them (2.3, 19.3%) 
7.3% Almost all of them (1.9, 18.3%) 
10.2% Some of them (3.4, 22. 1 %) 
14.4% Few of them (6.1, 27.2%) 
24.6% None of them (13.5, 38.8%) 
10.1% Don't know/ Cannot say (3.4, 21.9%) 
15.7% Does not apply (6.9, 28.7%) 


In general, how many of the VERY SMALL plants have implemented these 
mail handling security measures? 


5.9% Allofthem(1.2, 16.4%) 

5.6% Almost all of them (1.1, 16.0%) 

6.0%Someofthem(1.3, 16.6%) 

8.0% Few of them (2.3, 19.3%) 

35.3% None of them (22.4, 50. 1 %) 

6.0% Don't know/ Cannot say (1.2, 16.5%) 

21.3% Does not apply (1 1.0, 35.2%) 


In general, for the plants you are aware of that have implemented these mail 
handling security measures, what size plants are they? Are they: (check all 
that apply) 


58.7% Large plants (500 or more employees) (48.5, 68.8%) 
21.5% Small plants (11 -499 employees) (11.1, 35.4%) 
19.5% Very small plants (< 11 employees) (9.7, 33.2%) 
21.8% Don't know/ Cannot say (1 1.4, 35.7%) 
8.0% Does not apply (2.2, 19.2%) 


Now, let's deal with the area of computer systems security. Based on your 
knowledge and observations in the plants in your circuit, have you had the 
opportunity to notice or otherwise be aware of the following Computer 
Systems Security measures? 


Yes 


No 


Don 'l Know/ 
Cannot Say 


Computer systems security, like the use of network firewalls and virus 

detection systems, etc.? 


35.6% 
(22.1,51.1%) 


19.1% 

(9.0, 33.4%) 


45.2% 
(30.5, 60.6%) 


Do you know of any other security measures used to protect computer 
systems in the plants in your circuit? 


30.4% 
(17.7, 45.8%) 


45.5% 
(30.7, 60.8%) 


24.1% 
(12.7, 39.0%) 


In general, how many of the LARGE plants in your circuit would you say 
have implemented these computer systems security measures? 


15.1% All of them (6.3, 28.8%) 

13.8% Almost all of them (5.4, 27.2%) 

7.0% Some of them (1.6, 18.5%) 

2.0% Few of them (0. 1 , 1 1 .5%) 

10.8% None of them (3.6, 23.5%) 

30.2% Don't know/ Cannot say (17.6, 45.5%) 

21.1% Does not apply (10.5, 35.7%) 
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In general, how many of Che SMALL plants have implemented these 
computer system security measures? 


8.4% All of them (2.4, 19.7%) 

6.4% Almost all of them (1.4, 17.1%) 

3.9% Some of them (0.4, 13.5%) 

1.8% Few of them (0.1, 10.6%) 

18.3% None of them (8.8, 31.7%) 

36.4% Don't know/ Cannot say (23.2, 51.2%) 

15.3% Does not apply (6.7, 28.3%) 


In general, how many of the VERY SMALL plants have implemented these 
computer system security measures? 


6.0% All of them (1.3, 16.6%) 

2.4% Almost all of them (0.1, 1 1.2%) 

0.0% Some of them (0.0, 5.8%) 

2.2% Few of them (0.1, 11.0%) 

24.2% None of them (13.2, 38.4%) 

28.5% Don't know/ Cannot say (16.7, 43.0%) 

27.3% Does not apply (15.6, 41.7%) 


In general, for the plants you are aware of that have implemented these 
computer system security measures, what size plants are they? Are they: 
(check all that apply) 


36.9% Large plants (500 or more employees) (23.7, 51.7%) 
1 1 .0% Small plants ( 1 1 - 499 employees) (3.9, 23.0%) 
8.4% Very small plants (< 1 1 employees) (2.4, 19.7%) 
34.1% Don't know/ Cannot say (21.3, 48.9%) 
19.4% Does not apply (9.6, 33.1%) 


Now, think about any measures used to secure slaughter and processing 
facilities. Based on your knowledge and observations in the plants in your 
circuit, have you had the opportunity to notice or otherwise be aware of the 
following Slaughter and Processing Security measures? 


Yes 


No 


Don '1 Know/ 
Cannot Say 


The monitoring of production equipment? 


71.3% 
(56.1,83.7%) 


18.0% 
(8.3, 32.2%) 


10.6% 

(3.5, 23.3%) 


Trace-back and trace-forward tracking of raw materials? 


96.2% 
(85.9, 99.6%) 


0.0% 
(0.0, 6.3%) 


3.8% 
(0.4, 14.1%) 


The timely segregation of all products in case of deliberate contamination? 


76.4% 
(61.6. 87.7%) 


8.2% 
(2.2, 20.2%) 


15.3% 
(6.4, 29.0%) 


The comparison of the projected and actual use of restricted ingredients? 


74.1% 

(59.8, 85.5%) 


4.5% 
(0.7, 14.5%) 


11.8% 
(4.4, 24.0%) 


Verification of the integrity of packing materials before use? 


87.0% 
(73.8, 95.1%) 


2.4% 
(0.1, 11.8%) 


10.6% 
(3.5, 23.2%) 


Accurate inventory of finished products? 


88.7% 
(75.9, 96.1%) 


2.2% 
(0.1, 11.5%) 


9.1% 
(2.7,21.4%) 


Do you know of any other measures used to secure slaughter and processing 
facilities in the plants in your circuit? 


14.2% 
(5.7, 27.7%) 


85.8% 
(72.3, 94.3%) 


0.0% 
(0.0, 6.3%) 


In general, how many of the LARGE plants in your circuit would you say 
have implemented these slaughter and processing security measures? 


73.7% All of them (58.7, 85.6%) 
4.7% Almost all of them (0.7, 15.4%) 
6.5% Some of them (1.4, 17.9%) 
0.0% Few of them (0.0, 6.3%) 
3.9% None of them (0.4, 14.2%) 
0.0% Don't know/ Cannot say (0.0, 6.3%) 
11.1% Does not apply (3.7, 23.8%) 


In general, how many of the SMALL plants have implemented these slaughter 
and processing security measures? 


46.1% All of them (31.3, 61.4%) 
6.9% Almost all of them (1.5, 18.4%) 
19.5% Some of them (9.3, 33.8%) 
17.0% Few of them (7.6, 31.0%) 
4. 1 % None of them (0.5, 14.5%) 
0.0% Don't know/ Cannot say (0.0, 6.3%) 
6.4% Does not apply (1.3, 17.7%) 


In general, how many of the VERY SMALL plants have implemented these 
slaughter and processing security measures? 


32.9% All of them (19.8, 48.3%) 
8.9% Almost all of them (2.5, 21.0%) 
17.8% Some of them (8.1, 31.9%) 
17.4% Few of them (7.9, 31.5%) 
8.3% None of them (2.2, 20.3%) 
0.0% Don't know/ Cannot say (0.0, 6.3%) 
14.7% Does not apply (6.0. 28.2%) 
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In general, for the plants you are aware of that have implemented these 
outside security measures, what size plants are they? Are they: (check all that 
apply) 


80.4% Large plants (500 or more employees) (66.7. 90.2%) 
52.8% Small plants (11 - 499 employees) (41.4, 64.3%) 
49.3% Very small plants (< 11 employees) (37.7, 61.0%) 
0.0% Don't know/ Cannot say (0.0, 5.8%) 
0.0% Does not apply (0.0, 5.8%) 


Please take a moment to think about the area of personnel security. Based on 
your knowledge and observations in the plants in your circuit, have you had 
the opportunity to notice or otherwise be aware of the following Personnel 
Security measures? 


Yes 


No 


Don 't Know/ 
Cannot Say 


A system of positive identification of all personnel? 


93.8% 
(82.5, 98.8%) 


4.1% 
(0.4, 14.4%) 


2.2% 
(0.1, 11.5%i) 


Procedures for controlled entry during working and non-working hours? 


97.8% 
(88.5, 99.9%) 


0.0% 
(0.0, 6.3%) 


2.2% 
(0.1, 11.5%) 


Background checks? 


25.5% 
(13.8, 40.5%) 


10.6% 
(3.5, 23.2%) 


63.9% 
(48.4, 77.5%) 


Regularly provided orientations on security procedures? 


47.4% 

(32.5, 62.7%) 


11.0% 

(3.7, 23.8%) 


41.5% 
(27.2, 57.0%) 


Established procedures for allowing personal items in production areas? 


78.4% 
(63.8, 89.1%) 


12.8% 
(4.8, 25.9%) 


8.8% 
(2.5,21.0%) 


Do you know of any other measures used in personnel security in the plants in 

your circuit? 


18.7% 
(9.1, 32.2%) 


71.5% 
(57.0, 83.4%) 


0.0% 
(0.0, 5.8%) 


In general, how many of the LARGE plants in your circuit would you say 
have implemented these personnel security measures? 


60.2% All of them (44.7, 74.3%) 
18.0% Almost all of them (8.2, 32.1%) 
6.6% Some of them (1.4, 18.0%) 
2.0% Few of them (0. 1 , 1 1 .5%) 
2.2% None of them (0.1, 1 1.5%) 
0.0% Don't know/ Cannot say (0.0, 6.3%) 
11.1% Does not apply (3.7, 23.8%) 


In general, how many of the SMALL plants have implemented these 
personnel security measures? 


25.9% All of them (14.1, 40.9%) 
11.5% Almost all of them (4.0, 24.3%) 
32.5% Some of them (19.5, 47.9%) 
17.6% Few of them (8.0, 31.7%) 
8.3% None of them (2.2, 20.3%) 
0.0% Don't know/ Cannot say (0.0, 6.3%) 
4.2% Does not apply (0.5, 14.6%) 


In general, how many of the VERY SMALL plants have implemented these 
personnel security measures? 


21.6% All of them (10.9, 36.2%) 
10.7% Almost all of them (3.5, 23.4%) 
8.6% Some of them (2.4, 20.7%) 
16.2% Few of them (7.0, 30.0%) 
27.9% None of them (15.7, 43.1%) 
2.5% Don't know/ Cannot say (0.1, 12.1%) 
12.5% Does not apply (4.6, 25.6%) 


In general, for the plants you are aware of that have implemented these 
personnel security measures, what size plants are they? Are they: (check all 
that apply) 


76.2% Large plants (500 or more employees) (62.0, 87. 1 %) 
42.8% Small plants (1 1 - 499 employees) (32.3, 53.2%) 
40.6% Very small plants (< 1 1 employees) (29.6, 51.6%) 
0.0% Don't know/ Cannot say (0.0, 5.8%) 
2.0% Does not apply (0.1, 10.7%) 


Now I'd like to ask some questions about the section of the guidance related to 
in-house plant laboratories. 


Yes 


No 


Don 't Know/ 
Cannot Say 


First, are there any plants in your circuit with an in-house laboratory? An in- 
house laboratory may be used for water or bacterial testing, for instance. 


88.4% 
(76.2, 95.7%) 


0.0% 
(0.0, 5.8%) 




Based on your knowledge and observations in the plants with labs in your 
circuit, have you had the opportunity to notice or otherwise be aware of the 
following In-house Laboratory Security measures? 

Controlled entry to in-housc labs by lab personnel only? 


69.7% 
(54.4, 82.3%) 


15.4% 
(6.5,29.1%) 


14.9% 

(6.1,28.5%) 


Inventory control of pathogens? 


8.2% 
(2.2, 20.2%) 


10.7% 
(3.5, 23.3%) 


81.1% 
(66.8,91.1%) 


Equipment to destroy pathogens after testing? 


42.4% 
(28.0, 57.9%) 


8.0% 
(2.0, 19.8%) 


49.6% 
(37.2, 62.0%) 


The maintenance of records of destroyed pathogens? 


11.1% 

(3.7, 23.8%) 


12.6% 
(4.6, 25.6%) 


76.4% 
(61.6, 87.6%) 
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The controlled transport of pathogens to restricted areas only? 


8.5% 
(2.3, 20.6%) 


10.3% 
(3.3, 22.9%) 


81.2% 
(66.9, 91.2%) 


Do you know of any other in-house plant laboratory security measures in your 

circuit? 


10.4% 

(3.6, 22.3%) 


73.8% 
(59.4, 85.2%) 


4.0% 
(0.5, 13.8%) 


In general, how many of the LARGE plants with labs in your circuit would 
you say have implemented these in-house laboratory security measures? 


48.4% All of them (37.4, 59.4%) 

10.8% Almost all of them (3.6, 23.5%) 

6.5%Someofthem(1.4, 17.9%) 

8.2% Few of them (2.1, 20.1%) 

0.0% None of them (0.0, 6.3%) 

12.8% Don't know/ Cannot say (4.8, 25.9%) 

13.2% Does not apply (5.1, 26.5%) 


In general, how many of the SMALL plants with labs have implemented these 
in-house laboratory security measures? 


15.4% All of them (6.5, 29.1%) 

0.0% Almost all of them (0.0, 6.3%) 

4. 1 % Some of them (0.4, 14.4%) 

13.5% Few of them (5.2, 26.8%) 

17.3% None of them (7.7, 31.3%) 

10.4% Don't know/ Cannot say (3.4, 23.0%) 

39.3% Does not apply (25.3, 54.8%) 


In general, how many of the VERY SMALL plants with labs have 
implemented these in-house laboratory security measures? 


0.0% All of them (0.0, 5.8%) 

2.0% Almost all of them (0.1, 10.7%) 

0.0% Some of them (0.0, 5.8%) 

0.0% Few of them (0.0, 5.8%) 

27.9% None of them (16.2, 42.4%) 

4.0% Don't know/ Cannot say (0.5, 13.8%) 

56.7% Does not apply (44.8, 68.7%) 


In general, for the plants you are aware of that have implemented these in- 
house laboratory security measures, what size plants are they? Are they: 
(check all that apply) 


68.4% Large plants (500 or more employees) (53.7, 80.8%) 
20.5% Small plants (1 1 - 499 employees) (10.4, 34.3%) 
2.0% Very small plants (< 1 1 employees) (0.1, 10.7%) 
13.8% Don't know/ Cannot say (5.7, 26.5%) 
2.0% Does not apply (0.1, 10.7%) 


Finally, think about measures used to address the overall management of 
security in plants. Based on your knowledge and observations in the plants in 
your circuit, have you had the opportunity to notice or otherwise be aware of 
the following measures addressing the Overall Management of Security? 


Yes 


No 


Don't Know/ 
Cannot Say 


An active food security team or food security coordinator? 


46.2% 
(31.4,61.5%) 


31.2% 
(18.4, 46.6%) 


22.6% 
(11.6, 37.3%) 


The establishment and review of food security plan procedures for notifying 
law enforcement or public health officials when appropriate? 


41.7% 

(27.3, 57.2%) 


21.4% 
(10.7, 36.0%) 


36.9% 
(23.2, 52.4%) 


Management support for employees to monitor and report unusual events? 


63.0% 
(47.5, 76.8%) 


8.6% 
(2.4, 20.7%) 


28.4% 
(16.1,43.6%) 


Do you know of any other measures used to address the overall management 
of security in the plants in your circuit? 


6.7% 
(1.5, 18.2%) 


91.1% 
(79.0, 97.5%) 


2.2% 
(0.1, 11.5%) 


In general, how many of the LARGE plants in your circuit would you say 
have implemented measures addressing the overall management of security? 


36.6% All of them (22.9, 52.1%) 

15.1% Almost all of them (6.2, 28.7%) 

1 1 .7% Some of them (4.1, 24.6%) 

2.0% Few of them (0.1, 11.5%) 

6.5% None of them (1.3, 17.8%) 

14.8% Don't know/ Cannot say (6.0, 28.3%) 

13.4% Does not apply (5.2, 26.7%) 


In general, how many of the SMALL plants have implemented measures 
addressing the overall management of security? 


1 1.5% All of them (4.0, 24.3%) 

8.5% Almost all of them (2.3, 20.6%) 

14.7% Some of them (6.0, 28.3%) 

20.2% Few of them (9.8, 34.6%) 

17.3% None of them (7.7, 31.3%) 

17.0% Don't know/ Cannot say (7.5, 30.9%) 

10.9% Does not apply (3.6, 23.6%) 
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In general, how many of the VERY SMALL plants have implemented 
measures addressing the overall management of security? 


6.6% All of them (1.4, 18.0%) 

6.4% Almost all of them (1.3, 17.7%) 

0.0% Some of them (0.0, 6.3%) 

12.4% Few of them (4.6, 25.5%) 

36.1% None of them (22.5, 51.6%) 

19.3% Don't know/ Cannot say (9.2, 33.6%) 

19.2% Does not apply (9.1, 33.5%) 


In general, for the plants you are aware of that have implemented measures 
addressing the overall management of security, what size plants are they? 
Are they: (check all that apply) 


60.4% Large plants (500 or more employees) (45.6, 73.9%) 
20.9% Small plants (1 1 - 499 employees) (10.7, 34.7%) 
9.9% Very small plants (< 1 1 employees) (3.3, 21.7%) 
15.7% Don't know/ Cannot say (6.9, 28.7%) 
8.2% Does not apply (2.3, 19.5%) 


Keeping in mind the food security measures you have just indicated in your 
answers on the survey and that you are not responsible for enforcing them: 
In your opinion, how confident are you in the efforts of these plants to ensure 
the protection of food processed from acts of deliberate contamination? 


1 1.0% Very confident (3.7, 23.7%) 

36.6% Somewhat confident (22.9, 52.0%) 

16.1% Neither confident or not confident (6.9, 29.9%) 

26.2% Not very confident (14.3, 41.2%) 

10.2% Not at all confident (3.3, 22.8%) 

0.0% Don't know/ Cannot say (0.0, 6.3%) 


In your opinion, do you feel that field inspectors should monitor the food 
security measures proposed in the FSIS Security Guidelines to Food 
Processors? 


Yes 


No 


Don 'I Know/ 
Cannot Say 


64.7% 
(49.3, 78.2%) 


32.8% 
(19.7, 48.3%) 


2.4% 
(0.1, 11.9%) 
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Appendix IV: Comments from the 
U.S. Department of Agriculture 




4 r ££:% United States 



Food Safety 
and Inspection 
Service 



Washington, D.C. 
20250 



JAN 2 4 



Mr. Lawrence J. Dyckman 

Director, Natural Resources and Environment Team 

Food and Agriculture Issues 

United States General Accounting Office 

441 G Street, NW, Room 2T23 

Washington, DC 20548 

Dear Mr. Dyckman: 

Thank you for the opportunity to review and comment on the GAO Draft Report (GAO-03-342), 
"FOOD SECURITY: Voluntary Efforts Are Underway, but Federal Agencies Cannot Fully 
Assess Their Implementation" draft report. We generally agree with the contents of this report. 
However, please consider the following comment. 

On page 22 GAO concluded that the ". . .federal agencies cannot fully assess the vulnerability 
of the nation's food supply, or advise processors on needed security enhancements. Restate 
sentence to read: ". . .federal agencies may have a difficult time assessing the vulnerability of 
the nation's food supply. 

FSIS, as acknowledged on page 7 of the report, has completed a risk assessment of the food 
supply from farm to table. However, FSIS did not require information on the plant security 
measures to conduct its risk assessment. FSIS made the assumption that plant security 
measures could be overcome by a determined terrorist and that certain commodities or 
processes could be more at risk than others to an attack. Security measures could lessen the 
risk, but the risk would still exist. The risk assessment evaluated which agents could be used 
on the food supply, which agents are easy to obtain or produce, and assessed whether the 
food-processing product had any mitigation factors that would prevent or lessen an 
intentional attack. These assumptions were then used to develop a risk model. Knowing 
whether a plant employed one or several security measures was not needed to assess the risk. 

We have enclosed a few editorial comments for your consideration. 



Sincerely, 




Garry L. McKee, Ph.D., M.P.H. 
Administrator 



Enclosure 



FSIS FORM 2630-9 (6/66) 



EQUAL OPPORTUNITY IN EMPLOYMENT AND SERVICES 
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Appendix V: Comments from the Food and 
Drug Administration 




DEPARTMENT OF HEALTH & HUMAN SERVICES 



Food and Drug Administration 
Rockville MD 20857 



January 22, 2003 



Mr. Lawrence J. Dyckman 

Director, Natural Resources and Environment 

United States General Accounting Office 

441 G Street, NW 

Washington, DC 20548 



Dear Mr. Dyckman: 

Please find the enclosed comments from the Food and Drug Administration on the GAO 
draft report entitled, FOOD SECURITY: Voluntary Efforts Are Underway, but Federal 
Agencies Cannot Fully Assess Their Implementation (GAO-03-342). The Agency 
provided extensive technical comments directly to your staff. 

We appreciate the opportunity to review and comment on this draft report before its 
publication as well as the opportunity to work with your staff in developing this report. 



Sincerely, 




Mark B. McClellan, M.D., Ph.D. 
Commissioner of Food and Drugs 



Enclosure 
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Appendix V: Comments from the Food and Drug 
Administration 



General Comments by the Department of Health and Human Service's Food and Drug 
Administration (FDA) on General Accounting Office's (GAP) Draft Report, FOOD 
SECURITY: Voluntary Efforts Are Underway, but Federal Agencies Cannot Fully Assess 
Their Implementation (GAO-03-342) 

FDA appreciates the opportunity to comment on GAO's draft report. The report is factual 
and describes accurately the events and actions taken by FDA related to food security as 
well as the sensitive nature of the information related to security measures taken by the 
food-processing industry. 

GAO also accurately acknowledges efforts taken by FDA and other government agencies 
to enhance safety and security of regulated products. These efforts, in conjunction with 
the Public Health Security and Bioterrorism Preparedness and Response Act of 2002, are 
primarily directed toward imported products. 

The draft report discusses the different views between USDA and FDA on its authorities to 
address security concerns. In point of fact, our positions are very similar and any slight 
difference is more an issue of semantics rather than of substance. 

FDA would like to stress that the goal of its voluntary guidance to industry on security is 
not only to facilitate an exchange of information between FDA and industry on the subject 
of food security but also to heighten awareness of their food security practices. FDA does 
not possess sufficient resources in security expertise per se to provide consultation to the 
industry in this area. However, if we heighten awareness of security issues, the industry 
can consult with security experts to review their facility and adopt appropriate procedures. 
The role of the FDA investigator is first and foremost food safety and, as an ancillary role, 
to observe food security measures as they relate to the food safety investigation. FDA is 
only obliged to observe and comment when certain measures are not easily visible and do 
not link up and when they coincide with the primary purpose of the investigation. 

In addition, FDA agrees with GAO that Hazards Analysis Critical Control Points (HACCP) 
and other preventive controls are appropriate measures to reduce and or eliminate food 
safety contamination but do not believe HACCP affords similar advantages to deliberate 
contamination, tampering and or terrorist actions to the food supply. Accordingly, and in 
cooperation with the U.S. Air Force, FDA employed the Operational Risk Management 
approach to identify and minimize food security risks. 

GAO's Recommendations for Executive Action 

1 . In order to reduce the risk of deliberate contamination of food products, we are 

recommending that the Secretary of Health and Human Services and the Secretary of 
the Agriculture study their existing statutes and identify what additional authorities 
they may need relating to security measures at food-processing facilities. Based on the 
results of the study, the agencies should seek additional authority from the Congress, 
as needed. 
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Administration 



FDA response: 

FDA believes that its authorities under the Federal Food, Drug, and Cosmetic Act and the 
Public Health Service Act would extend to the regulation of facility security measures to 
prevent the intentional contamination of food products to the extent they overlap with 
food safety. 

As we have previously reported, the General Counsel in the Department of Health and 
Human Service's Offic e of the Assistant Secretary for Legislation advised that FDA's 
authorities under the Federal Food, Drug, and Cosmetic Act and the Public Health Service 
Act provide FDA with tools to adopt measures to control insanitary preparation, packing, 
and holding conditions that may lead to unsafe food, detect contamination of food, and 
control contaminated food. However, HHS counsel also advised that FDA's food safety 
authorities do not extend to the regulation of physical facility security measures to prevent 
intentional contamination of food products. FDA counsel believes that to the extent that 
food safety and security overlap, FDA might be able to require industry to take steps to 
improve security depending on the particular measure at issue, but observed that there is 
likely to be little overlap between safety and security in various areas, e.g., background 
checks of employees. 

2. To increase field inspectors' knowledge and understanding of food security issues and 
facilitate their discussions about the voluntary security guidelines with plant personnel, 
we are also recommending that the Secretary of the Department of Health and Human 
Services and the Secretary of Agriculture provide training for the agency's field staff on 
the security measures discussed in the voluntary guidelines. 

FDA response: 

FDA plans to conduct "formal" training on the guidance to industry on food security in 
addition to the formal instructions previously provided to FDA field staff on the guidance. 
We agree that the training FDA delivers to field staff will: 

• Discuss the content of the guidance and how food security activities are integrated into 
a food safety inspection; 

• Address food security as it relates to the guidance to industry as an ancillary function 
of a food safety inspection and/or investigation; 

• Encourage inspectors not to delve beyond those facility operations that are directly a 
part of a food safety investigation; and 

• Not be considered to confer expert credentials for security upon FDA investigators but 
simply improve their abilities to heighten awareness of facility management on food 
security at the time of the food safety investigation. 
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QAO'S ]\/Jission ^ e General Accounting Office, the audit, evaluation and investigative arm of 

Congress, exists to support Congress in meeting its constitutional responsibilities 
and to help improve the performance and accountability of the federal 
government for the American people. GAO examines the use of public funds; 
evaluates federal programs and policies; and provides analyses, 
recommendations, and other assistance to help Congress make informed 
oversight, policy, and funding decisions. GAO's commitment to good government 
is reflected in its core values of accountability, integrity, and reliability. 
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